Scenario construction system, scenario construction device, and scenario construction method

Abstract

To provide a scenario construction system, a scenario construction apparatus, and a scenario construction method which can construct an aggressive scenario while properly reducing implementation costs and individual dependency.SOLUTION: A scenario construction system has a processor. The processor acquires threat information including an attack technique defining an attack method in a cyber attack. The processor extracts the attack technique from the threat information. The processor generates an attack flow defining a procedure for executing the attack technique. The processor associates attack codes used in the attack with the attack flow so as to construct an attack scenario which is information relating to a scenario in the cyber attack.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a scenario construction system, a scenario construction device, and a scenario construction method. [Background technology]

[0002] Cyber ​​attacks are increasing and becoming more sophisticated every year, and the need for countermeasures is growing. One example of such countermeasures is the task of determining, when a new vulnerability or attack is reported, whether an organization's environment may be affected by the attack, and if so, the expected extent of the damage, and whether countermeasures are necessary. Penetration testing is a method for evaluating the security resistance of computer and network environments. This involves formulating attacks that may occur in the environment, and conducting the attacks on a desk or, in some cases, virtually, to evaluate whether the environment has resistance to the attacks. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-5165 [Patent Document 2] Special Publication No. 2021-515943 [Non-patent literature]

[0004] [Non-Patent Document 1] Valentine Legoy, Marco Caselli, Christin Seifert, Andreas Peter: Automated Retrieval of ATT&CK Tactics and Techniques for Cyber ​​Threat Reports, https: / / arxiv.org / abs / 2004.14322 [Non-Patent Document 2] Seungoh Choi, Jeong-Han Yun, and Byung-Gil Min: Probabilistic Attack Sequence Generation and Execution Based on MITER ATT&CK for ICS Datasets, Cyber ​​Security Experimentation and Test Workshop, https: / / dl.acm.org / doi / abs / 10.1145 / 3474718.3474722 Summary of the Invention [Problem to be solved by the invention]

[0005] While evaluating the attack resistance of computer and network environments through penetration testing etc. is important for maintaining security, currently most of this work (constructing attack scenarios, evaluating resistance, etc.) requires manual work and advanced skills. For this reason, given the current situation where attacks are increasing year by year, it is thought that it is not easy to manually carry out the above operations against all attacks.

[0006] When conducting a penetration test, it is necessary to first construct an attack scenario, and since the type of test to be performed depends on this attack scenario, it can be said to be the most important step. When constructing this attack scenario, first, the extraction of the attack scenario from threat information depends heavily on the knowledge of the person in charge, and issues include the high implementation cost and high personal dependency.

[0007] The technology of Patent Document 1 focuses on generating scenarios of possible incidents, and is different in scope from technologies that aim to generate scenarios of attacks that have actually occurred and to evaluate the impact of the attacks. The technology of Patent Document 2 focuses on creating an environment for testing, and scans and tests to be performed in that environment must be created separately. The technology of Non-Patent Document 1 is limited to extracting attack techniques, and does not go as far as to construct an attack scenario by combining attack techniques, and this must be done separately and manually. The technology of Non-Patent Document 2 has limitations such as the fact that attack techniques must be input manually and that conditions for generating attack sequences must be tuned manually.

[0008] Assisting or automating the construction of attack scenarios is expected to alleviate the challenges associated with conducting penetration tests, and although there are existing technologies that partially achieve this, challenges remain.

[0009] Therefore, an object of the present invention is to provide a scenario construction system, a scenario construction device, and a scenario construction method that can construct attack scenarios while more appropriately reducing implementation costs and personal dependency. [Means for solving the problem]

[0010] According to a first aspect of the present invention, there is provided a scenario construction system as follows. The scenario construction system includes a processor. The processor acquires threat information including attack techniques that define a method of attack in a cyber-attack, extracts the attack techniques from the threat information, generates an attack flow that defines a procedure for executing the attack techniques based on the extracted attack techniques, and links the attack code used in the attack to the attack flow, thereby constructing an attack scenario, which is information regarding a scenario in a cyber-attack.

[0011] According to a second aspect of the present invention, there is provided a scenario construction device as described below. The scenario construction device includes a processor. The processor acquires threat information including attack techniques that define a method of attack in a cyber-attack, extracts the attack techniques from the threat information, generates an attack flow that defines a procedure for executing the attack techniques based on the extracted attack techniques, and links the attack code used in the attack to the attack flow, thereby constructing an attack scenario, which is information regarding a scenario in a cyber-attack.

[0012] According to a third aspect of the present invention, there is provided a scenario construction method as described below. The scenario construction method is a method performed using a processor. This method acquires threat information including attack techniques that define a method of attack in a cyber-attack, extracts the attack techniques from the threat information, generates an attack flow that defines a procedure for executing the attack techniques based on the extracted attack techniques, and links the attack code used in the attack to the attack flow, thereby constructing an attack scenario, which is information regarding a scenario in a cyber-attack. Effect of the Invention

[0013] According to the present invention, a scenario construction system, a scenario construction device, and a scenario construction method are provided that can construct an attack scenario while more appropriately reducing implementation costs and dependency on individuals. Note that problems, configurations, and effects other than those described above will become apparent from the description of the embodiments of the invention below. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an example of the overall configuration of a system according to a first embodiment. [Diagram 2] FIG. 13 is a diagram illustrating an example of an information collection destination management table. [Diagram 3] FIG. 11 is a diagram illustrating an example of a threat information list. [Figure 4] FIG. 13 is a diagram illustrating an example of an attack code database. [Diagram 5] FIG. 13 is a diagram illustrating an example of a list of attack scenarios. [Figure 6]1 is a flowchart outlining an example of processing executed by the attack scenario-based penetration system; [Figure 7] 11 is a flowchart illustrating an example of a threat information collection process. [Figure 8] 13 is a flowchart illustrating an example of an attack technique extraction process. [Figure 9] 13 is a flowchart illustrating an example of a missing item estimation and attack flow generation process. [Figure 10] 11 is a diagram illustrating an example of a process using a co-occurrence model and a transition model. FIG. [Figure 11] 13 is a flowchart illustrating an example of an attack sequence generation process. [Figure 12] 11 is a flowchart illustrating an example of a screen depiction process. [Figure 13] 13 is an example of a display of information regarding an attack scenario. [Figure 14] FIG. 11 is a diagram illustrating an example of the configuration of an entire system according to a second embodiment. [Figure 15] FIG. 13 is a diagram illustrating an example of an environment list. [Figure 16] FIG. 13 is a diagram illustrating an example of an influence list. [Figure 17] 11 is a flowchart illustrating an example of an environmental information acquisition process. [Figure 18] 13 is a flowchart illustrating an example of a simulated environment construction process. [Figure 19] 11 is a flowchart illustrating an example of an attack execution and impact assessment process. [Figure 20] 11 is a flowchart illustrating an example of an evaluation result notification process. [Figure 21] FIG. 13 is a diagram showing an example of an evaluation result depiction screen. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention should not be interpreted as being limited to the description of the embodiment shown below. It will be easily understood by those skilled in the art that the specific configuration can be changed without departing from the concept or purpose of the present invention.

[0016] In the configurations of the invention described below, the same or similar configurations or functions are given the same reference symbols, and duplicate descriptions may be omitted.

[0017] In this specification, the terms "first," "second," "third," and the like are used to identify components and do not necessarily limit the number or order.

[0018] In order to facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings, etc. may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not limited to the position, size, shape, range, etc. disclosed in the drawings, etc.

[0019] First Embodiment A first embodiment will be described with reference to Figs. 1 to 13. In the first embodiment, the processing of an attack scenario-based penetration system (scenario construction device) when an attack scenario is automatically generated will be described. In the following description, "attack technique" defines a method of attack in a cyber attack, such as hiding, information theft, or lateral expansion. "Attack code" refers to specific code or programs for executing each attack technique. "Attack sequence" refers to a sequence including information on the order in which each attack technique and attack code are executed. In addition, the one including all of these is called an "attack scenario."

[0020] First, an example of the configuration of an attack scenario-based penetration system will be described with reference to Fig. 1. Fig. 1 shows an example of the configuration of an attack scenario-based penetration system according to an embodiment of the present invention. The attack scenario-based penetration system 101 is connected to user terminals (117a, 117b, 117c) operated by users via a network 118a. In addition, the attack scenario-based penetration system 101 is connected to the Internet 119 via a network 118b.

[0021] The attack scenario-based penetration system 101 is, for example, a computer including a CPU (Central Processing Unit) 103, a main memory 104 for temporarily storing data to be processed by the CPU 103, a non-transient storage device 105 such as a hard disk or a flash memory having a capacity for storing programs and large amounts of data, an IF (102a, 102b) which is an interface for communication, an input / output device 106 constituting an input / output interface such as a USB memory (USB flash drive) or an external hard disk, and a communication path 107 connecting these devices. The communication path 107 is, for example, an information transmission medium such as a bus or a cable. The program and data may be stored in the storage device 105 in advance, or may be introduced into the storage device 105 from a device equipped with an external non-transient storage medium via a network or via a portable non-transient storage medium.

[0022] The CPU 103 (processor) executes various programs stored in the storage device 105 and read out to the main memory 104. The CPU 103 collects threat information by executing a threat information collection program 108. The CPU 103 extracts attack techniques from threat information by executing an attack technique extraction program 109. The CPU 103 estimates missing items of the extracted attack techniques and creates an attack flow by executing a missing item estimation and attack flow generation program 110. The CPU 103 links the attack flow with the attack code and generates an attack sequence by executing an attack sequence generation program 111. The CPU 103 presents information about the attack scenario constructed by the above programs to a user, etc. by executing a screen depiction program 112.

[0023] The storage device 105 stores an information collection destination management table 113 that manages the destinations of information collection by the threat information collection program 108, a threat information list 114 that stores the collected threat information, an attack code database 115 that is a knowledge base for linking attack techniques with attack codes, and an attack scenario list 116 that stores constructed attack scenarios.

[0024] Incidentally, each of the above programs and data may be, for example, stored in advance in the main memory 104 or the storage device 105, or may be installed (loaded) from another device via the input / output device 106 or the IF (102a, 102b) when necessary.

[0025] The configuration of the attack-scenario-based penetration system 101 described with reference to FIG. 1 is an example, and is not limited thereto. For example, any processor that executes a predetermined process may be used, and the CPU 103 may be another semiconductor device. When data input / output via the input / output device 106 is not performed, the input / output device 106 may be omitted. The main memory 104 may be configured using a RAM (Random Access Memory). The user terminals (117a, 117b, 117c) may be configured using appropriate input devices and output devices, and the user terminals (117a, 117b, 117c) may be provided in a scenario construction system including the attack-scenario-based penetration system 101 (scenario construction device), and may be provided in multiple units or one unit.

[0026] Next, the above-mentioned various data (113-116) will be described with reference to Fig. 2 to Fig. 5. First, an example of the information collection destination management table 113 will be described with reference to Fig. 2. As described above, the information collection destination management table 113 is data that appropriately compiles the collection destinations of threat information. Fig. 2 is a diagram showing an example of the information collection destination management table.

[0027] As shown in FIG. 2, the information collection destination management table 113 includes, for example, an ID 201, a name 202, a URL 203, a last collection date and time 204, and a collection frequency 205.

[0028] The ID 201 is a field for storing identification information for uniquely identifying a threat information collection destination. As an example, a number is stored as the identification information in the ID 201 indicating the information collection destination (sometimes called a threat information collection destination ID).

[0029] The name 202 is a field for storing the name of the threat information collection destination. For example, the name of the collection destination corresponding to the entry in which the threat information collection destination ID 201 is “0” is “Security Blog 1.”

[0030] The URL 203 is a field for storing the URL of the threat information collection destination. For example, the collection destination corresponding to an entry in which the threat information collection destination ID 201 is "0" is "blog.example.com".

[0031] The last collection date and time 204 indicates the date and time when threat information was acquired from a threat information collection destination. For example, an entry with a threat information collection destination ID 201 of "0" indicates that information was collected from the destination at 00:00:00 on Jan. 1, 1970. The data format of the time stored in the last collection date and time 204 is not limited, and may be any data format such as Unixtime as long as the data format allows the time to be determined.

[0032] The collection frequency 205 indicates the frequency at which threat information is collected from a threat information collection destination. For example, an entry with a threat information collection destination ID 201 of "0" indicates that information collection is attempted every 24 hours.

[0033] Moreover, the information collection destination management table 113 described in FIG. 2 is just an example, and the present invention is not limited to this.

[0034] Next, an example of the threat information list 114 will be described with reference to Fig. 3. As described above, the threat information list 114 is data that compiles information related to collected threat information. Fig. 3 is a diagram showing an example of the threat information list.

[0035] As shown in FIG. 3, the threat information list 114 includes, for example, an ID 301, a collection date 302, a URL 303, and an attack scenario 304.

[0036] The ID 301 is a field for storing identification information for uniquely identifying threat information. As an example, a number is stored as the identification information in the ID 301 indicating the threat information (sometimes called a threat information ID).

[0037] Collection date 302 is a field that stores the date and time when the threat information was acquired. For example, the threat information of an entry with a threat information ID 301 of "0" indicates that it was collected at 00:00:00 on January 1, 1970. The data format of the time stored in collection date 302 is not limited, and may be any data format such as Unixtime as long as it allows the time to be determined.

[0038] The URL 303 is a field for storing the URL of the threat information. For example, the collection destination corresponding to the entry with the threat information ID 301 of "0" is "blog.example.com / article / 1.html".

[0039] Attack scenario 304 is a field that stores a value indicating whether an attack scenario has been generated for threat information. For example, threat information of an entry with threat information ID 301 of "0" indicates that an attack scenario has been generated. The data format stored in attack scenario 304 is not limited, and may be any data format as long as it is possible to determine whether an attack scenario has been generated.

[0040] Furthermore, the threat information list 114 described in FIG. 3 is merely an example and is not limited to this.

[0041] Next, an example of the attack code database 115 will be described with reference to Fig. 4. The attack code database 115 is, for example, a database that compiles information regarding the correspondence between attack techniques and attack codes. Fig. 4 is a diagram showing an example of the attack code database.

[0042] As shown in FIG. 4, the attack code database 115 includes, for example, an attack technique 401 and an attack code 402 .

[0043] The attack technique 401 is a field that stores identification information for uniquely identifying an attack technique. For example, the attack technique of the top entry of the attack technique 401 is "attack technique A." The data format stored in the attack technique 401 is not limited, and may be any data format as long as the attack technique can be identified.

[0044] Attack code 402 is a field that stores a specific attack code corresponding to an attack technique. For example, the attack code in the top entry of attack code 402 is "cd $HOME && find . -print | sed ...". The data format stored in attack code 402 is not limited, and may be any data format as long as the attack code can be identified.

[0045] Moreover, the attack code database 115 described in FIG. 4 is merely an example, and is not limited to this.

[0046] Next, an example of the attack scenario list 116 will be described with reference to Fig. 5. As described above, the attack scenario list 116 is information on the contents of the constructed attack scenario. Fig. 5 is a diagram showing an example of the attack scenario list.

[0047] As shown in FIG. 5, the attack scenario list 116 includes, for example, a step 501, an attack technique 502, and an attack code 503.

[0048] Step 501 is a field for storing identification information for uniquely identifying the execution order (procedure) of the attack techniques. As an example, numbers are stored in ascending order in step 501 as identification information.

[0049] Attack technique 502 is a field that stores identification information for uniquely identifying the attack technique executed at each step. For example, an attack technique with step 501 of "0" indicates "attack technique A." The data format stored in attack technique 502 is not limited, and may be any data format as long as the attack technique can be identified.

[0050] Attack code 503 is a field that stores a specific attack code corresponding to an attack technique executed at each step. For example, the attack code of "0" in step 501 is "ls-recurse." The data format stored in attack code 503 is not limited, and may be any data format as long as the attack code can be identified.

[0051] Moreover, the attack scenario list 116 described in FIG. 5 is just an example and is not limiting.

[0052] Next, a description will be given of an example of processing executed by the attack-scenario-based penetration system 101. Fig. 6 is a flowchart outlining an example of processing executed by the attack-scenario-based penetration system.

[0053] The CPU 103 of the attack-scenario-based penetration system 101 periodically executes the processing described below by appropriately executing a program.

[0054] The CPU 103 executes the threat information collection program 108 to collect threat information from the outside (step 601). The process of collecting threat information will be described in detail later.

[0055] Next, the CPU 103 determines whether the collected information includes new information (step 602). If the CPU 103 determines that the collected information does not include new information, the attack-scenario-based penetration system 101 ends the process. On the other hand, if the CPU 103 determines that the collected information includes new information, the process proceeds to step 603.

[0056] Next, the CPU 103 of the attack scenario-based penetration system 101 executes an attack scenario generation process for all new information acquired as threat information (step 603). Specifically, the CPU 103 executes the attack technique extraction program 109 to extract attack techniques from the threat information (step 604). Then, the process proceeds to step 605. The threat technique extraction process will be described in detail later.

[0057] Next, the CPU 103 executes the missing item estimation and attack flow generation program 110 to estimate missing items of the extracted attack techniques and generate attack flows (step 605). Note that the estimation of missing items and the generation of attack flows will be described in detail later.

[0058] Next, the CPU 103 executes the attack sequence generation program 111 to generate an attack sequence based on the attack flow (step 606). The generation of the attack sequence will be explained in detail later.

[0059] The CPU 103 performs the above-mentioned processes (steps 603 to 606) on all new information, and upon completion, ends the attack scenario generation process.

[0060] The processing flow of the attack-scenario-based penetration system described in FIG. 6 is just an example and is not limited to this.

[0061] Next, an example of a threat information collection process executed by the attack-scenario-based penetration system 101 will be described in detail with reference to Fig. 7. Fig. 7 is a flowchart illustrating an example of the threat information collection process.

[0062] When the threat information collection program 108 executed by the CPU 103 receives an execution instruction, it starts the process described below.

[0063] The threat information collection program 108 acquires a list of information collection destinations from the information collection destination management table 113, and collects threat information based on the list (step 701). Here, it is assumed that a list including entries configured with the threat information collection destination ID 201 is acquired. In processing the threat information collection program 108, the CPU 103 refers to the last collection date and time 204 and the collection frequency 205 in the information collection destination management table 113, and calculates the elapsed time from the last collection date and time 204 of the threat information collection destination to program execution. Then, if the elapsed time exceeds the collection frequency 205, the CPU 103 performs a threat information collection process.

[0064] Next, the threat information collection program 108 determines whether the collected threat information includes new information (step 702). If new information is not included, the process ends. If new information is included, the process proceeds to step 703.

[0065] Next, the threat information collection program 108 saves the acquired threat information in the threat information list 114 (step 703), and then terminates the process. Specifically, the threat information collection program 108 adds an entry to the threat information list 114, assigns an ID 301 to the added entry, and stores the collection date of the threat information in collection date 302 and the URL of the threat information in URL 303. In addition, the threat information collection program 108 creates an attack scenario 304 as "not generated".

[0066] 7 is merely an example and is not limiting. As an example, the attack-scenario-based penetration system 101 can appropriately collect threat information from the outside via the Internet 119. In this case, for example, the attack-scenario-based penetration system 101 may automatically acquire threat information at a predetermined collection frequency by referring to the URL 203 in the information collection destination management table 113.

[0067] On the other hand, threat information may be input to the attack-scenario-based penetration system 101 via the input / output device 106. In this case, as an example, the threat information may be input using a USB memory or the like that stores predetermined threat information (e.g., threat information at the URL 203 destination). Then, in response to the input of the threat information, data such as the threat information list 114 may be updated as appropriate.

[0068] Next, an example of the attack technique extraction process executed by the attack scenario-based penetration system 101 will be described in detail with reference to Fig. 8. Fig. 8 is a flowchart illustrating an example of the attack technique extraction process.

[0069] When an execution instruction is received, the attack technique extraction program 109 executed by the CPU 103 starts the process described below.

[0070] The attack technique extraction program 109 acquires a list of threat information from the threat information list 114 (step 801). Here, it is assumed that a list including an entry configured with ID 301 is acquired.

[0071] Next, the attack technique extraction program 109 executes the attack technique extraction process from step 803 onwards for the threat information for which the attack scenario has not been generated (step 802). At this time, if there is no threat information for which the attack scenario has not been generated, the process ends.

[0072] The attack technique extraction program 109 performs appropriate string matching on the threat information having a string to extract the attack technique from the threat information (step 803), and proceeds to step 804. Here, in step 803, for example, a fixed expression of the attack technique is used, and an expression that matches the expression is extracted as the attack technique. It is also considered that there is some threat information in which an identifier is assigned to the attack technique by various frameworks or the like. Therefore, when the attack technique is described using the identifier, an expression that matches the identifier may be extracted as the attack technique.

[0073] Next, the attack technique extraction program 109 extracts attack techniques from the threat information using a machine learning model (step 804), and proceeds to step 805. For example, expressions used to describe attack techniques are modeled in advance using machine learning. Then, similarities with expressions in the threat information are calculated, and if a highly similar expression is found, the modeled attack expression is extracted as being included in the threat information. This allows for the extraction of attack techniques that were missed in processing such as that performed in step 803.

[0074] Next, the attack technique extraction program 109 reflects the attack techniques extracted up to step 804 in the attack scenario list 116 (step 805). Specifically, an attack scenario list is prepared for each threat information, and the attack techniques are stored in the attack technique 502. After attack techniques are extracted for all threat information, the process ends.

[0075] The attack technique extraction process described in FIG. 8 is an example, and is not limited thereto. For example, in this example, a process focused on extracting attack techniques has been described, but an attack group name or malware name may be extracted from threat information and stored as complementary information for an attack scenario. In addition, in the attack technique extraction process, it is sufficient that attack techniques are appropriately extracted from threat information, and for example, modifications such as executing only one of step 803 and step 804 may be made in consideration of the volume of threat information.

[0076] In this way, attack techniques are extracted from threat information based on the attack technique extraction process, but the attack techniques described in the threat information are not necessarily comprehensive, and there may be cases where attack techniques are missing. That is, there are cases where attack techniques are missing in the threat information. Therefore, the attack scenario-based penetration system 101 according to the embodiment estimates the missing attack techniques and appropriately complements the attack techniques. Next, an example of missing item estimation and attack flow generation processing executed by the attack scenario-based penetration system 101 will be described in detail with reference to FIG. 9. FIG. 9 is a flowchart for explaining an example of missing item estimation and attack flow generation processing.

[0077] When an execution instruction is received, the missing item estimation and attack flow generation program 110 executed by the CPU 103 starts the process described below.

[0078] The missing item estimation and attack flow generation program 110 acquires a list of threat information from the threat information list 114 (step 901). Here, it is assumed that a list including an entry composed of ID 301 is acquired.

[0079] Next, the missing item estimation and attack flow generation program 110 performs the processes from step 903 onwards for the attack scenarios that have not been processed by the program 110, and reflects the results in the attack scenarios (step 902). At this time, if there are no attack scenarios that have not been processed, the process ends.

[0080] The missing item estimation and attack flow generation program 110 extracts missing items based on the co-occurrence between attack techniques (step 903), and proceeds to step 904. For example, the missing item estimation and attack flow generation program 110 calculates the co-occurrence between attack techniques in advance as a knowledge base, and extracts missing items that have a high co-occurrence with the attack techniques already extracted.

[0081] Next, the missing item estimation and attack flow generation program 110 extracts missing items based on the transition model, then converts them into an attack flow (step 904) and proceeds to step 905. For example, the missing item estimation and attack flow generation program 110 constructs a transition model of attack techniques in advance, and extracts attack techniques on a path that is not included in the input when solving a path problem under a constraint that passes through all of the extracted attack techniques as missing items. This also derives the transition of attack techniques, which is then converted into an attack flow.

[0082] Next, the missing item estimation and attack flow generation program 110 reflects the attack techniques extracted up to step 904 and the attack flow consisting of transition information in the attack scenario list 116 (step 905). Specifically, if there is an attack technique extracted as a missing item by the attack technique extraction program 109 in the attack scenario list 116 recorded for each threat information, the attack technique 502 is updated and step 501 is added based on the order of the attack flow. Then, after processing has been performed for all uncompleted attack scenarios, the processing ends.

[0083] Here, an example of the processing of the above-mentioned steps 903 and 904 will be specifically described with reference to FIG. 10. As shown in FIG. 10, the missing item estimation and attack flow generation program 110 estimates the missing (missing) attack technique by inputting the attack technique extracted from the threat information into a co-occurrence model. Then, when the missing attack technique is estimated, this attack technique is complemented. Here, the co-occurrence model is a model showing the co-occurrence relationship of the attack techniques, and is constructed by calculating the co-occurrence between the attack techniques as a knowledge base in advance. In FIG. 10, the solid line edge indicates high co-occurrence, and the dotted line edge indicates low co-occurrence. Therefore, in this example, by inputting the attack techniques (A, D), the missing of the attack technique E, which has high co-occurrence, is estimated, and the attack technique E is complemented.

[0084] Furthermore, the missing item estimation and attack flow generation program 110 estimates defects in the attack techniques and complements the attack techniques using a transition model. Also, the missing item estimation and attack flow generation program 110 generates attack flows for the attack techniques. Here, the transition model is a model that indicates the transition relationship of the attack techniques, and is constructed in advance using logs, etc.

[0085] The missing item estimation and attack flow generation program 110 estimates and complements the missing attack techniques by solving the transition model as a path problem using the attack techniques extracted from the threat information and the attack techniques estimated from the viewpoint of co-occurrence as constraint conditions, and generates an attack flow. Therefore, in the example of FIG. 10, the missing item estimation and attack flow generation program 110 estimates the missing attack technique B by solving the transition model as a path problem using the attack techniques (A, D, E) as constraint conditions, and generates an attack flow (A, B, D, E) that complements the attack technique B. Note that the numbers in the transition model indicate the ease of transition (probability of transition), and basically, an attack flow related to a path that is easy to transition is generated, but in this example, the above attack flow (A, B, D, E) is generated due to the constraint conditions. In this way, in this embodiment, a process is performed to estimate the missing threat information by combining step 903 and step 904, and to generate a complemented attack flow if there is a missing threat information.

[0086] The missing item estimation and attack flow generation process described in Fig. 9 and the like is merely an example, and is not limited to this. For example, attack group names and malware names extracted from threat information may be used to supplement commonly used attack techniques.

[0087] In addition, it is preferable to perform the process described in FIG. 10 from the viewpoint of accuracy, but it may be modified as appropriate. For example, a modification may be made such as performing one of step 903 and step 904 in consideration of the volume of threat information. Here, in the case where the process of step 904 is omitted, the missing (deficiency) of the attack technique may be estimated and complemented in step 903 to generate an attack flow. For example, as shown in FIG. 10, in the case where the missing of the attack technique E is estimated based on the attack technique (A, D), an attack flow (A, E, D) in which the attack technique E is complemented may be generated. On the other hand, in the case where the process of step 903 is omitted, the missing of the attack technique may be estimated and complemented based on the constraint condition of the attack technique extracted from the threat information in step 904 to generate an attack flow. For example, in the case of FIG. 10, the missing of the attack technique (B, E) may be estimated using the extracted attack technique (A, D) as a constraint condition, and an attack flow (A, B, D, E) in which the attack technique (B, E) is complemented may be generated.

[0088] Next, an example of an attack sequence generation process executed by the attack scenario-based penetration system 101 will be described with reference to Fig. 11. Fig. 11 is a flowchart for explaining an example of the attack sequence generation process. In the attack sequence generation process, a process is performed to link an attack code to an attack technique in a generated attack flow.

[0089] When an execution instruction is received, the attack sequence generation program 111 executed by the CPU 103 starts the process described below.

[0090] The attack sequence generation program 111 acquires a list of threat information from the threat information list 114 (step 1101). Here, it is assumed that a list including an entry configured with ID 301 is acquired.

[0091] Next, the attack sequence generation program 111 executes the attack code linking process from step 1103 onwards for the attack techniques of the threat information for which the generation of the attack scenario has not been completed (step 1102). At this time, if there is no threat information for which the generation of the attack scenario has not been completed, the process ends.

[0092] Next, the attack sequence generation program 111 extracts an attack code linked to the attack technique from the threat information (step 1103), and proceeds to step 1104. For example, if a specific attack code is described around the attack technique, it is extracted.

[0093] Next, for the attack techniques for which the attack code extraction and linking from the threat information failed in step 1103, the attack sequence generation program 111 links the attack code using the attack code database 115 (step 1104), and proceeds to step 1005. For example, as described above, the attack code database 115 having typical attack codes 402 for each attack technique 401 is constructed in advance, and the attack techniques are linked to the attack codes.

[0094] In addition, in the processes of steps 1103 and 1104, the attack techniques complemented in the above-mentioned missing item estimation and attack flow generation processes are also linked to attack codes.

[0095] Next, the attack sequence generation program 111 reflects the attack codes associated with the attack techniques extracted up to step 1104 in the attack scenario list 116 (step 1105). Specifically, the attack technique extraction program 109 and the missing item estimation and attack flow generation program 110 update the attack code 503 for each attack technique in the attack scenario list recorded for each threat information, and complete the attack scenario. In addition, the attack scenario 304 in the threat information list 114 is updated to "generated". The attack sequence generation program 111 generates attack sequences and creates attack scenarios based on the attack sequences for all threat information for which attack scenario generation has not been completed, and then ends the process.

[0096] The attack sequence generation process described in FIG. 11 is an example, and is not limited thereto. For example, attack codes often used in attack group names or malware names extracted from threat information may be linked to attack techniques. In addition, in the attack sequence generation process, it is sufficient to appropriately obtain attack codes corresponding to attack techniques, and modifications such as executing one of steps 1103 and 1104 may be performed.

[0097] The attack scenario-based penetration system 101 executes a screen depiction process for presenting various information to the user, separate from the process described in Fig. 6. This causes data to be depicted on the screen relating to the attack scenario to be output, and various information is output to an appropriate display device. Next, an example of the screen depiction process will be described with reference to Fig. 12. Fig. 12 is a flowchart for explaining an example of the screen depiction process.

[0098] When an execution instruction is received, the screen depiction program 112 executed by the CPU 103 starts the process described below.

[0099] The screen depiction program 112 acquires information on the attack scenario to be depicted from the attack scenario list 116 (step 1201 ), and proceeds to step 1202 .

[0100] Next, the screen depiction program 112 generates and outputs data for depicting information about the attack scenario to be depicted on the screen (step 1102), and ends the process.

[0101] The method of displaying the screen described with reference to FIG. 12 is merely an example and is not limiting.

[0102] Next, an example of an information display mode will be described with reference to Fig. 13. Fig. 13 shows an example of displaying information related to an attack scenario.

[0103] As shown in Fig. 13, the displayed screen includes an information source 1301 and an attack scenario 1302. The information source 1301 indicates basic information regarding threat information, which is the information source when the attack scenario is generated. The information source 1301 includes, for example, the ID of the threat information, the collection date, the name of the information source, and the URL. The attack scenario 1302 indicates basic information regarding the attack scenario. The attack scenario 1302 includes, for example, the attack step in the attack scenario, the attack technique in the step, and the attack code related to the attack technique.

[0104] By displaying the above-mentioned information on an appropriate display device, it is expected that the visibility of the information related to the attack scenario for the user can be improved and the efficiency of the work related to the attack scenario can be improved. As an example, a display device may be arranged on the user terminal (117a, 117b, 117c) side, and the information may be displayed on this display device.

[0105] Although the depiction screen based on the analysis results of each program according to the first embodiment has been illustrated, this depiction screen is merely an example and is not limited to this. For example, any information may be depicted in any format as long as it is information that supports the construction of a user's attack scenario or is related to the attack scenario.

[0106] According to the above description, a scenario construction device and a scenario construction system are provided that include a processor, which acquires threat information including attack techniques that define the attack methods in a cyber-attack, extracts the attack techniques from the threat information, generates an attack flow that defines the procedures for executing the attack techniques based on the extracted attack techniques, and links the attack code used in the attack to the attack flow, thereby constructing an attack scenario, which is information regarding a scenario in a cyber-attack.

[0107] These scenario construction devices and scenario construction systems can reduce implementation costs and dependency on individual personnel by automatically linking attack code to attack techniques based on threat information.

[0108] It is known that the attack techniques described in threat information are not necessarily comprehensive, and that there may be cases where there are omissions. For this reason, it is necessary to fill in the gaps between the lines or omitted parts. In addition, since there is a gap between the granularity of the threat information and the attack code for actual attacks, it is necessary to link it to the actual attack code and sublimate it into an attack scenario that can actually be carried out. At this point, it is conceivable for the user to fill in the gaps, but in this case, the implementation cost and the influence of personal nature can be considered.

[0109] In this embodiment, the scenario construction device and scenario construction system automatically complement gaps and link to attack code based on information extracted from threat information, thereby reducing implementation costs and personal dependency, and is expected to improve the authenticity and comprehensiveness of attack scenarios by compensating for gaps in threat information.

[0110] <Second embodiment> Next, a second embodiment will be described with reference to Fig. 14 to Fig. 21. In the second embodiment, in addition to constructing an attack scenario, the process of an attack-scenario-based penetration system that automatically evaluates the impact when the attack scenario is actually executed in a computer environment or a network environment and notifies the result to an organization that has the environment will be described.

[0111] Specifically, the attack scenario-based penetration system 1401 (scenario construction device) performs the following in addition to the processes described in the first embodiment: acquisition of environmental information of the evaluation target, construction of a simulated environment for executing an attack scenario, evaluation of the execution and impact of an attack, and notification of the evaluation result. The second embodiment will be described below, focusing on the differences from the first embodiment. Note that the same contents as those described in the first embodiment may be omitted.

[0112] 14 is a diagram showing a configuration example of an attack-scenario-based penetration system 1401 according to the second embodiment. Each hardware configuration (1401 to 1407) of the attack-scenario-based penetration system 1401 of the second embodiment can be the same as that of the first embodiment. Also, it is similar in that it is connected to user terminals (1423a, 1423b, 1423c) via a network 1425a and is connectable to the Internet 1426 via a network 1425b.

[0113] The programs in the second embodiment are similar to those in the first embodiment, including a threat information collection program 1408, an attack technique extraction program 1409, a missing item estimation and attack flow generation program 1410, an attack sequence generation program 1411, and a screen depiction program 1416, as well as an environmental information acquisition program 1412 for acquiring environmental information of the evaluation target, a simulated environment construction program 1413 for constructing a simulated environment for executing an attack scenario, an attack execution and impact evaluation program 1414 for executing an attack and evaluating its impact, and an evaluation result notification program 1415 for notifying the evaluation results.

[0114] The data structure in the second embodiment is similar to that in the first embodiment, including an information collection destination management table 1417, a threat information list 1418, an attack code database 1419, and an attack scenario 1420, as well as an environment list 1421 that manages environmental information of the evaluation target, and an impact list 1422 that manages the evaluation results regarding whether or not there is an impact.

[0115] The processing executed by the threat information collection program 1408, the attack technique extraction program 1409, the missing item estimation and attack flow generation program 1410, the attack sequence generation program 1411, and the screen depiction program 1416 in the second embodiment can be the same as in the first embodiment.

[0116] 14 is merely an example and is not intended to be limiting. According to the present embodiment, a scenario construction system including the attack-scenario-based penetration system 1401 is provided.

[0117] Next, an example of the environment list 1421 will be described with reference to Fig. 15. Fig. 15 is a diagram showing an example of the environment list.

[0118] As shown in FIG. 15, the environment list 1421 includes, for example, an organization ID 1501, a device 1502, software 1503, and a version 1504.

[0119] The organization ID 1501 is a field for storing identification information for uniquely identifying which organization the item belongs to. For example, a number is stored as the identification information in the organization ID 1501.

[0120] The equipment 1502 indicates information on equipment present in the environment of the organization. For example, an organization with an organization ID 1501 of "0" indicates that multiple equipment including "Server A" exists. The data format stored in the equipment 1502 is not limited, and may be any data format as long as the equipment can be identified.

[0121] Software 1503 indicates the type of software installed in the device. For example, it indicates that "OS A" is installed in "Server A." The data format stored in software 1503 is not limited, and may be any data format as long as the software can identify it.

[0122] The version 1504 indicates the version of the software installed in the device. For example, it indicates that the version of "OS A" installed in "Server A" is "11." The data format stored in the version 1504 is not limited, and may be any data format as long as the version can be identified.

[0123] The environment list 1421 described in FIG. 15 is just an example, and the present invention is not limited to this.

[0124] Next, an example of the impact list 1422 will be described with reference to Fig. 16. Fig. 16 is a diagram showing an example of the impact list. As shown in Fig. 16, the impact list 1422 is configured to include, for example, a step 1601, an attack technique 1602, an attack code 1603, and an impact presence / absence 1604.

[0125] Step 1601 is a field for storing identification information for uniquely identifying the execution order of the attack scenarios. As an example, numbers are stored in ascending order as identification information in step 1601.

[0126] Attack technique 1602 is a field that stores identification information for uniquely identifying the attack technique executed at each step. For example, the attack technique for step 1601 being "0" indicates "attack technique A." The data format stored in attack technique 1602 is not limited, and may be any data format as long as the attack technique can be identified.

[0127] Attack code 1603 is a field that stores a specific attack code corresponding to an attack technique executed at each step. For example, the attack code of "0" in step 1601 is "ls -recurse." The data format stored in attack code 1603 is not limited, and may be any data format as long as the attack code can be identified.

[0128] Impact 1604 is a field that stores a value indicating whether the devices of the target organization may be affected by the attack technique executed in each step. For example, for an attack technique in which step 1601 is "0", "yes" is stored, indicating that the devices may be affected by the attack technique. The data format stored in impact 1604 is not limited, and may be any data format as long as it is a data format that allows the presence or absence of an impact to be determined.

[0129] The influence list 1422 described in FIG. 16 is just an example, and is not limited to this.

[0130] Next, an example of processing executed by the attack scenario-based penetration system 1401 will be described with reference to Fig. 17 to Fig. 20. The attack scenario-based penetration system 1401 of the second embodiment executes, in succession, as an example, an environment information acquisition program 1412, a simulated environment construction program 1413, an attack execution and impact evaluation program 1414, and an evaluation result notification program 1415 in order to evaluate the impact when an attack scenario is actually executed in a computer environment or a network environment, in addition to constructing an attack scenario. An example of the processing flow of each program will be described below.

[0131] An example of an environment information acquisition process executed by the attack-scenario-based penetration system 1401 of the second embodiment will be described with reference to Fig. 17. Fig. 17 is a flowchart illustrating an example of the environment information acquisition process.

[0132] When an execution instruction is received, the environmental information acquisition program 1412 executed by the CPU 1403 starts the process described below.

[0133] The environment information acquisition program 1412 acquires the environment information of the target organization (step 1701). Here, the equipment 1402, software 1403, and version 1404 corresponding to each entry of the environment list 1421 are acquired. The environment information acquisition program 1412 acquires the environment information by, for example, running a program for collecting the information in the target organization and receiving the results online.

[0134] Next, the environmental information acquisition program 1412 stores the acquired environmental information in the environmental list 1421 (step 1702), and then ends the process.

[0135] 17 is an example, and is not limited to this. For example, the environmental information of the target organization may be acquired by email or offline, and reflected in the environmental list 1421. For example, the environmental information may be acquired using an input / output device.

[0136] Next, an example of a simulated environment construction process executed by the attack-scenario-based penetration system 1401 will be described with reference to Fig. 18. Fig. 18 is a flowchart illustrating an example of the simulated environment construction process.

[0137] When an execution instruction is received, the simulated environment construction program 1413 executed by the CPU 1403 starts the process described below.

[0138] The simulated environment construction program 1413 acquires the environment information of the organization to be evaluated from the environment list 1421 (step 1801 ), and proceeds to step 1802 .

[0139] Next, the simulated environment construction program 1413 constructs a simulated environment based on the acquired environment information (step 1802), and then terminates the process. The simulated environment construction program 1413 reproduces the environment of the organization to be evaluated in a virtual environment, for example, by utilizing a framework for constructing a virtual environment.

[0140] The method of constructing a simulated environment described with reference to FIG. 18 is merely an example, and the present invention is not limited to this.

[0141] Next, an example of an attack execution and impact assessment process executed by the attack-scenario-based penetration system 1401 of the second embodiment will be described with reference to Fig. 19. Fig. 19 is a flowchart illustrating an example of an attack execution and impact assessment process.

[0142] When an execution instruction is received, the impact assessment program 1414 executed by the CPU 1403 starts the process described below.

[0143] The attack execution and impact assessment program 1414 acquires an attack scenario to be executed from the attack scenario list 1420 (step 1901).

[0144] Next, the attack execution and impact assessment program 1414 executes the processes from step 1903 onwards for each step of the attack scenario (step 1902). When all attack steps have been executed, the process ends.

[0145] The attack execution and impact assessment program 1414 executes the attack of the step in question against the simulated environment constructed by the simulated environment construction program 1412 (step 1903 ), and proceeds to step 1904 .

[0146] Next, the attack execution and impact assessment program 1414 assesses whether the attack executed in step 1903 has had an impact in the simulated environment (step 1904), and proceeds to step 1905. For example, it determines whether there has been an impact based on whether the execution of the attack code has been completed normally, whether the device in the simulated environment has stopped, etc.

[0147] Next, the attack execution and impact assessment program 1414 reflects the evaluation result in step 1904 in the impact list 1422 (step 1905). Specifically, the impact assessment program 1414 records the step, attack technique, and attack code of the attack scenario as step 1601, attack technique 1602, and attack code 1603, respectively, and then records whether or not there is an impact in impact presence / absence 1604 of the same entry.

[0148] 19 is merely an example, and is not intended to be limiting. For example, an attack scenario may be customized or tuned according to the devices and software included in the environment list 1421, and then an attack may be performed and an evaluation may be performed.

[0149] Next, an example of an evaluation result notification process executed by the attack-scenario-based penetration system 1401 of the second embodiment will be described with reference to Fig. 20. Fig. 20 is a flowchart illustrating an example of the evaluation result notification process.

[0150] When an execution instruction is received, the evaluation result notifying program 1415 executed by the CPU 1403 starts the process described below.

[0151] The evaluation result notification program 1415 acquires the impact evaluation result of the evaluation target organization from the impact list 1422 (step 2001 ), and proceeds to step 2002 .

[0152] Next, the evaluation result notifying program 1415 outputs the acquired impact evaluation result. In this example, the evaluation result notifying program 1415 notifies the evaluation target organization of the acquired impact evaluation result (step 2002), and then terminates the processing. For example, when the evaluation target organization is the other organization 1424 (i.e., when the other organization 1424 is the request source), the result is notified to a terminal of the other organization 1424 (other organization terminal) via the network 1425b. The terminal of the other organization 1424 is configured appropriately. The terminal can be configured as an appropriate computer, for example. An input device, a display device, etc. may be provided appropriately on the terminal side, and these configurations may be connected to the terminal appropriately.

[0153] The method of notifying the evaluation result described in Fig. 20 is an example, and is not limited thereto. For example, the evaluation result may be output to a user terminal (1423a, 1423b, 1423c), and the evaluation result may be notified to the target organization via a user (e.g., an analyst who analyzes the result). Also, a method may be realized in which the user acquires the evaluation result via the input / output device 1406 and notifies the target organization of the evaluation result. Also, when the evaluation target organization is the own organization, a method may be realized in which the evaluation result is notified via the user terminal (1423a, 1423b, 1423c) or the input / output device 1406.

[0154] The output evaluation result may be displayed on an appropriate display device. Next, an example of a display mode of the evaluation result will be described with reference to Fig. 21. Fig. 21 is a diagram showing an example of an evaluation result display screen.

[0155] As shown in FIG. 21, the displayed screen includes an information source 2101, an impact of an attack 2102, and an attack scenario and individual impact 2103. The information source 2101 is the same as in the first embodiment. The impact of an attack 2102 is information indicating the presence or absence of an impact on the execution of an attack scenario. By referring to the impact of an attack 2102, a user or the like can determine whether the attack scenario includes a step that has an impact when the attack scenario is executed. The attack scenario and individual impact 2103 is information summarizing the attack technique, attack code, and impact for each step of the attack scenario. Therefore, by referring to the attack scenario and individual impact 2103, a user or the like can determine the impact of the execution of the attack scenario in more detail.

[0156] By displaying the above-described information, it is expected that the visibility of information related to attack scenarios for users will be improved, and the efficiency of work related to attack scenarios will be improved.

[0157] Although the depiction screen based on the analysis results of each program according to the second embodiment has been illustrated, this depiction screen is merely an example and is not limited thereto. For example, any information may be depicted in any format as long as it is information that supports the construction of a user's attack scenario or information related to the attack scenario.

[0158] According to the second embodiment, the attack scenario-based penetration system 1401 automatically constructs an attack scenario as in the first embodiment, while executing the attack in a simulated environment, and automatically evaluates the presence or absence of an impact of the attack and the degree of the impact if there is an impact (i.e., which step in the attack scenario will be affected). This makes it possible to further reduce the cost and personal dependency of the penetration test.

[0159] Also, as exemplified in the impact assessment process section, by customizing and tuning the attack scenario according to the environment of the evaluation target (i.e., by changing the attack scenario according to the environment of the evaluation target), it is expected that tests and evaluations that are more suitable for the evaluation target can be performed. Note that customization and tuning of the attack scenario may be performed by the execution of an appropriate program by a processor, or may be performed by a user, etc.

[0160] In addition, although the above mainly describes testing in an existing environment, it may also be used for other purposes, such as conducting product testing before shipping a product and measuring its resistance to attacks. In addition to actually attacking a mock environment, it is also acceptable to conduct impact assessments through desk-top studies and simulations based on attack scenarios.

[0161] Although the embodiment has been described above, the present invention is not limited to the above embodiment and includes various modifications. For example, it is possible to add, delete, or replace a part of the configuration of the embodiment with another configuration.

[0162] The attack-scenario-based penetration system (scenario construction device) may be provided with an input device and an output device (display device) used by a user as appropriate. In this case, the user terminal may be omitted.

[0163] The attack-scenario-based penetration system (101, 1401) may be deployed on a cloud. The generated attack scenarios and data on the evaluation results may be transmitted to user terminals or terminals of other organizations that are capable of communicating with each other via the Internet (119, 1426). [Explanation of symbols]

[0164] 101 Attack Scenario-Based Penetration System 108 Threat Intelligence Collection Program 109 Attack Technique Extraction Program 110 Missing Item Estimation and Attack Flow Generation Program 111 Attack sequence generator

Claims

1. A processor is provided. The processor, Obtain threat information including attack techniques that define the methods of attack in cyber attacks, Extracting the attack techniques from the threat information; generating an attack flow that defines a procedure for executing the attack technique based on the extracted attack technique; By linking the attack code used in the attack to the attack flow, an attack scenario is constructed, which is information regarding a scenario in a cyber attack; The processor, estimating an attack technique that is missing in the threat information and generating the attack flow that complements the attack technique; A scenario construction system comprising:

2. A scenario construction system as claimed in claim 1, The processor, The missing attack techniques are estimated using a co-occurrence model that shows the co-occurrence relationship of attack techniques or a transition model that shows the transition relationship of attack techniques. A scenario construction system comprising:

3. 2. A scenario construction system according to claim 1, comprising: The processor, By executing the attack scenario, a cyber attack resistance evaluation is performed. A scenario construction system comprising:

4. A scenario construction system as claimed in claim 3, The processor, Evaluating resistance to each attack technique included in the attack scenario; A scenario construction system comprising:

5. A scenario construction system as claimed in claim 4, The processor, constructing a simulated environment for evaluation according to an evaluation target for executing the attack scenario; A scenario construction system comprising:

6. A scenario construction system as claimed in claim 5, The processor, Modify the attack scenario according to the environment to be evaluated. A scenario construction system comprising:

7. A scenario construction system as claimed in claim 5, A user terminal used by a user who operates the system is provided, The user can change the attack scenario according to the environment of the evaluation target using the user terminal. A scenario construction system comprising:

8. 2. A scenario construction system according to claim 1, comprising: A user terminal used by a user who operates the system is provided, The processor, outputting data depicting the attack scenario on a screen to the user terminal; A scenario construction system comprising:

9. A scenario construction system as claimed in claim 3, comprising: A user terminal used by a user who operates the system is provided, The processor, outputting data depicting a result of the resistance evaluation of the executed attack scenario on a screen to the user terminal; A scenario construction system comprising:

10. A scenario construction system as claimed in claim 8, comprising: a scenario construction device having the processor, The user terminal and the scenario construction device, Each is placed in a different location, The scenario construction device comprises: It is deployed on the cloud. A scenario construction system comprising:

11. 2. A scenario construction system according to claim 1, comprising: A third-party terminal is provided which is a terminal of an organization different from the organization that operates the system; The processor, outputting data depicting the attack scenario on a screen to the other organization's terminal; A scenario construction system comprising:

12. A scenario construction system as claimed in claim 3, comprising: A third-party terminal is provided which is a terminal of an organization different from the organization that operates the system; The processor, outputting data depicting a result of the resistance evaluation of the executed attack scenario on a screen to the other organization's terminal; A scenario construction system comprising:

13. A processor is provided. The processor, Obtain threat information including attack techniques that define the methods of attack in cyber attacks, Extracting the attack techniques from the threat information; generating an attack flow that defines a procedure for executing the attack technique based on the extracted attack technique; By linking the attack code used in the attack to the attack flow, an attack scenario is constructed, which is information regarding a scenario in a cyber attack; The processor, estimating an attack technique that is missing in the threat information and generating the attack flow that complements the attack technique; A scenario construction device comprising:

14. A scenario construction method performed by using a processor, comprising: Obtain threat information including attack techniques that define the methods of attack in cyber attacks, Extracting the attack techniques from the threat information; generating an attack flow that defines a procedure for executing the attack technique based on the extracted attack technique; By linking the attack code used in the attack to the attack flow, an attack scenario is constructed, which is information regarding a scenario in a cyber attack; estimating an attack technique that is missing in the threat information and generating the attack flow that complements the attack technique; A scenario construction method comprising:

Images