Sharing system, sharing method, countermeasure device and program

Abstract

To provide a sharing system or the like capable of improving swiftness of disclosing information relating to security, and ease of adjusting a range of disclosure. A sharing system 10 according to an aspect of the present disclosure includes a countermeasure accepting unit 121 that, in a case of log information of an object device representing a state of security indicates an anomaly state, accepts, from a countermeasure device that generates countermeasure information representing a countermeasure to the anomaly state, the countermeasure information, a countermeasure notifying unit 122 that notifies the object device of the countermeasure information that is accepted, an effect accepting unit 131 that accepts, from the countermeasure device that determines an effect of the countermeasure as to the anomaly state from log information after notification of the countermeasure information, the effect, and an effect information providing unit 132 that provides effect information representing the effect to a predetermined effect information provision object.

Description

[Technical field]

[0001] The present disclosure relates to techniques for sharing information. [Background technology]

[0002] Technologies relating to sharing of security-related information are disclosed in the following documents.

[0003] Patent Document 1 describes a security countermeasure search device that receives extraction conditions for searching for security countermeasures and extracts security countermeasure information that is correlated with the received extraction conditions from a security countermeasure database. This security countermeasure search device displays the extracted security countermeasure information in order of priority. The security countermeasure search device also receives usefulness information of security countermeasures and reflects the received usefulness information in the security countermeasure database.

[0004] Patent document 2 describes a security evaluation device that calculates a target index value, which is an effectiveness index value of an inputted goal, and an implementation index value, which is an effectiveness index value of security measures being implemented, and outputs comparison information comparing the target index value and the implementation index value as an evaluation result.

[0005] Patent Document 3 describes an information security system that identifies autonomous systems that have been subjected to similar attacks by analyzing attack information on a plurality of autonomous systems, and identifies the difference in security information possessed by the identified autonomous systems. This information security system transmits notification information based on the difference in security information possessed by a first autonomous system and not possessed by a second autonomous system among the identified autonomous systems to an information sharing device. The information sharing device transmits the notification information to a second autonomous system. The second autonomous system implements security measures against the attack based on the notification information.

[0006] Patent Document 4 describes a security countermeasure planning support system that lists security countermeasures that can be introduced for each threat item based on the components included in the attack path of the threat item and the target parts of the security countermeasures. This system calculates, for each of the listed security countermeasures, the sum of the effect values ​​of the threat items whose risks are reduced when the security countermeasure is introduced, as the system risk reduction effect of the security countermeasure, based on the relationship between the target points of the security countermeasures and the effect values ​​indicating the degree of the effect of the security countermeasures. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2005-259014 A [Patent Document 2] JP 2013-025429 A [Patent Document 3] JP 2017-162243 A [Patent Document 4] JP 2018-077597 A Summary of the Invention [Problem to be solved by the invention]

[0008] The technology of Patent Document 1 makes it possible to know the usefulness of security information. The technology of Patent Document 2 makes it possible to compare the effectiveness of implemented security measures with targets using index values. The technology of Patent Document 3 makes it possible to standardize security measures for multiple autonomous systems under the same attack. The technology of Patent Document 4 makes it possible to compare the effectiveness of risk reduction achieved by security measures. However, the technologies of Patent Documents 1 to 4 cannot improve the promptness of disclosure of security-related information and the ease of adjusting the scope of disclosure.

[0009] One example of an objective of the present disclosure is to provide a sharing system or the like that can improve the speed at which security-related information is disclosed and the ease with which the scope of disclosure can be adjusted. [Means for solving the problem]

[0010] A shared system according to one aspect of the present disclosure comprises a countermeasure receiving means for receiving countermeasure information from a countermeasure device that generates countermeasure information indicating a countermeasure for an abnormal condition when log information indicating the security status of a target device indicates the abnormal condition, a countermeasure notification means for notifying the target device of the received countermeasure information, an effect receiving means for receiving the effect from the countermeasure device that determines the effect of the countermeasure against the abnormal condition from the log information after the countermeasure information has been notified, and an effect information providing means for providing effect information indicating the effect to a specified effect information provision target.

[0011] A sharing method according to one aspect of the present disclosure receives countermeasure information from a countermeasure device that generates countermeasure information representing countermeasures against an abnormal condition when log information representing the security status of a target device indicates an abnormal condition, notifies the target device of the received countermeasure information, receives the effect from the countermeasure device that determines the effectiveness of the countermeasure against the abnormal condition from the log information after the countermeasure information has been notified, and provides effect information representing the effect to a specified effect information provision target.

[0012] A storage medium according to one embodiment of the present disclosure stores a program that causes a computer to execute a countermeasure reception process that receives countermeasure information from a countermeasure device that generates countermeasure information representing countermeasures against an abnormal state when log information representing the security status of a target device indicates the abnormal state; a countermeasure notification process that notifies the target device of the received countermeasure information; an effect reception process that receives the effect from the countermeasure device that determines the effect of the countermeasure against the abnormal state from the log information after the countermeasure information has been notified; and an effect information provision process that provides effect information representing the effect to a specified effect information provision target.

[0013] A countermeasure device according to one embodiment of the present disclosure comprises a log receiving means for receiving log information indicating a security status output from a target device, a countermeasure generating means for generating countermeasure information indicating a countermeasure for the abnormal state if the log information indicates an abnormal state, a countermeasure providing means for providing the countermeasure information, an effect determining means for determining the effectiveness of the countermeasure from post-countermeasure log information which is log information received after the countermeasure information is provided, and an effect output means for outputting effect information indicating the effect.

[0014] An analysis method according to one aspect of the present disclosure receives log information indicating a security status output from a target device, and if the log information indicates an abnormal state, generates countermeasure information indicating countermeasures to be taken against the abnormal state, provides the countermeasure information, determines the effectiveness of the countermeasures from post-countermeasure log information, which is log information received after the countermeasure information is provided, and outputs effect information indicating the effect.

[0015] A storage medium according to one embodiment of the present disclosure causes a computer to execute a log reception process that receives log information indicating a security status output from a target device, a countermeasure generation process that generates countermeasure information indicating a countermeasure for the abnormal state if the log information indicates an abnormal state, a countermeasure provision process that provides the countermeasure information, an effect determination process that determines the effectiveness of the countermeasure from post-countermeasure log information, which is log information received after the countermeasure information has been provided, and an effect output process that outputs effect information indicating the effect. Effect of the Invention

[0016] The present disclosure has the effect of improving the speed at which security-related information can be disclosed and the ease with which the scope of disclosure can be adjusted. [Brief description of the drawings]

[0017] [Figure 1] FIG. 1 is a block diagram illustrating an example of a configuration of a shared system according to a first embodiment of the present disclosure. [Diagram 2] FIG. 2 is a flowchart illustrating an example of the operation of the sharing system according to the first embodiment of the present disclosure. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a configuration of a shared system according to the second embodiment of the present disclosure. [Figure 4] FIG. 4 is a flowchart illustrating an example of the operation of the sharing system according to the second embodiment of the present disclosure. [Diagram 5] FIG. 5 is a flowchart illustrating an example of the operation of the sharing system according to the second embodiment of the present disclosure. [Figure 6] FIG. 6 is a block diagram illustrating an example of the configuration of a countermeasure device according to the third embodiment of the present disclosure. [Figure 7] FIG. 7 is a flowchart illustrating an example of the operation of the countermeasure device according to the third embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating an example of a hardware configuration of a computer capable of realizing a shared system and a countermeasure device according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

[0019] <First embodiment> First, a first embodiment of the present disclosure will be described in detail with reference to the drawings.

[0020] <Configuration> FIG. 1 is a block diagram showing an example of the configuration of a shared system according to the first embodiment of the present disclosure. In the example shown in FIG. 1, the shared system 10 of the present embodiment includes a countermeasure receiving unit 121, a countermeasure notification unit 122, an effect receiving unit 131, and an effect information providing unit 133. When log information showing the security state of a target device shows an abnormal state, the countermeasure receiving unit 121 receives the countermeasure information from a countermeasure device that generates countermeasure information showing a countermeasure for the abnormal state. The countermeasure notification unit 122 notifies the target device of the received countermeasure information. The effect receiving unit 131 receives the effect from the countermeasure device that judges the effect of the countermeasure for the abnormal state from the log information after the countermeasure information is notified. The effect information providing unit 133 provides effect information showing the effect to a predetermined effect information providing target.

[0021] The above-mentioned target device is, for example, a network device such as a router or a switch. The log information may be, for example, information including a security alert. In the description of the present disclosure, the log information is also written as a log object. The security alert may indicate information regarding an attack on the target information. The information regarding the attack may be information indicating an abnormal operation or an abnormal state of the target device caused by the attack (i.e., an abnormal state). The countermeasure information may be information representing a security countermeasure that can be interpreted by the target device. In other words, the target device to which the countermeasure information is notified receives the countermeasure information and executes the countermeasure indicated by the countermeasure information. The countermeasure device generates countermeasure information representing a countermeasure against the abnormal state indicated by the log information by any of various existing methods. In the description of the present disclosure, the countermeasure information is also written as a countermeasure object. The effect information is information representing a change in the state of the target device caused by the countermeasure information. The effect information may represent, for example, a change in the log information after the effect information is notified to the target device, with respect to the log information before the effect information is notified to the target device. In the description of the present disclosure, the effect information is also written as an effect object. The effect information provision target may be a target person (email address) included in a predetermined target person list (e.g., a list of email addresses). The effect information provision target may be, for example, a device included in a predetermined device list.

[0022] <Operation> Fig. 2 is a flowchart showing an example of the operation of the shared system according to the first embodiment of the present disclosure. In the example shown in Fig. 2, first, the countermeasure receiving unit 121 receives countermeasure information indicating a countermeasure for an abnormal state indicated by log information or the like from a countermeasure device (step S10). Next, the countermeasure notifying unit 122 notifies the target device of the received countermeasure information (step S11). The effect receiving unit 131 receives from the countermeasure device the effect of the countermeasure for the abnormal state determined from the log information after the countermeasure information is notified (step S12). The effect information providing unit 133 provides effect information indicating the effect to an effect information providing target (step S13).

[0023] <Effects> The present disclosure has an effect of improving the promptness of disclosure of security-related information and the ease of adjusting the scope of disclosure. This is because the effect information providing unit 133 provides effect information, which is received from the countermeasure device by the effect receiving unit 131 and indicates the effect of the countermeasure against the abnormal state of the target device, to a predetermined effect information providing target. The predetermined effect information providing target is a target person included in the above-mentioned predetermined list of targets, or a device included in the above-mentioned predetermined list of devices, etc. By appropriately determining this predetermined effect information providing target, the scope of disclosure can be easily adjusted.

[0024] <Second embodiment> Next, a shared system according to a second embodiment of the present disclosure will be described in detail with reference to the drawings.

[0025] <Configuration> FIG. 3 is a block diagram showing an example of the configuration of a shared system according to a second embodiment of the present disclosure. In the example shown in FIG. 3, the shared system 100 according to the present embodiment includes a log receiving unit 111, a log notification unit 112, a log storage unit 113, and a log information providing unit 114. The shared system 100 according to the present embodiment also includes a countermeasure receiving unit 121, a countermeasure notification unit 122, a countermeasure storage unit 123, and a countermeasure information providing unit 124. The shared system 100 according to the present embodiment also includes an effect receiving unit 131, an effect storage unit 132, and an effect information providing unit 133. The shared system 100 is communicably connected to each of the target device 200, the countermeasure device 300, and the notification destination device 400.

[0026] <Target device 200> The target device 200 has the same functions as the target device of the first embodiment, and performs the same operations as the target device of the first embodiment. The target device 200 of this embodiment adds log concealment period information indicating a period during which the log information is concealed (hereinafter, also referred to as log concealment period) to the log information output by the target device 200. The target device 200 of this embodiment outputs log information including log concealment period information, for example. The target device 200 may set the log concealment period according to, for example, a predetermined rule for determining the log concealment period. The log concealment period may be represented by the date and time when the log concealment period ends. In this case, the log concealment period information is information indicating the date and time when the log concealment period ends.

[0027] <Countermeasure Device 300> The countermeasure device 300 has the same functions as the countermeasure device of the first embodiment, and performs the same operations as the countermeasure device of the first embodiment. The following mainly describes the differences between the countermeasure device 300 of the present embodiment and the countermeasure device of the first embodiment.

[0028] The countermeasure device 300 of this embodiment adds countermeasure concealment period information indicating a period during which the countermeasure information is concealed (hereinafter, also referred to as countermeasure concealment period) to the countermeasure information output by the countermeasure device 300. The countermeasure device 300 of this embodiment outputs countermeasure information including countermeasure concealment period information, for example. The countermeasure device 300 may set the countermeasure concealment period according to, for example, a predetermined rule for determining the countermeasure concealment period. The countermeasure concealment period may be represented by the date and time when the countermeasure concealment period ends. In this case, the countermeasure concealment period information may be the date and time when the countermeasure concealment period ends.

[0029] Furthermore, the countermeasure device 300 assigns an identifier (hereinafter, referred to as countermeasure information identifier) ​​to countermeasure information indicating a countermeasure for the abnormal state indicated by the received log information. The countermeasure device 300 adds the log information identifier of the received log information and the countermeasure information identifier of the countermeasure information indicating a countermeasure for the abnormal state indicated by the log information to the countermeasure information. In other words, the countermeasure device 300 generates countermeasure information indicating a countermeasure for the abnormal state indicated by the received log information and including the log information identifier and the countermeasure information identifier of the log information. Then, the countermeasure device 300 transmits the generated countermeasure information to the countermeasure receiving unit 121.

[0030] Furthermore, the countermeasure device 300 receives log information after transmitting countermeasure information indicating a countermeasure for the abnormal state indicated by the received log information. The log information received after transmitting countermeasure information indicating a countermeasure for the abnormal state indicated by the received log information is referred to as post-countermeasure log information. The countermeasure device 300 determines the degree of mitigation of the abnormal state for which a countermeasure has been generated in the state indicated by the post-countermeasure log information received after transmitting the countermeasure information indicating the countermeasure.

[0031] If the determined degree of reduction does not satisfy a first criterion (hereinafter, referred to as an effective criterion), the countermeasure device 300 determines that the countermeasure indicated by the generated countermeasure information was not effective. In this case, the countermeasure device 300 may add countermeasure information indicating the countermeasure determined to be ineffective to the invalid countermeasure information. The invalid countermeasure information represents countermeasure information indicating the countermeasure determined to be ineffective for the abnormal state indicated by the log information. The invalid countermeasure information may be represented by, for example, a combination of the log information identifier of the log information indicating the abnormal state and the countermeasure information identifier of the countermeasure information determined to be ineffective for the abnormal state. Then, the countermeasure device 300 generates countermeasure information representing other countermeasures for the abnormal state indicated by the log information, and transmits the generated countermeasure information to the countermeasure receiving unit 121.

[0032] If the determined degree of reduction satisfies a first criterion (i.e., an effective criterion), the countermeasure device 300 determines that the countermeasure indicated by the countermeasure information transmitted immediately before is effective. The countermeasure device 300 adds countermeasure information indicating the countermeasure determined to be effective to the effective countermeasure information. The effective countermeasure information indicates countermeasure information indicating a countermeasure determined to be effective for the abnormal state indicated by the log information. The effective countermeasure information may be represented, for example, by a combination of a log information identifier of the log information indicating the abnormal state and a countermeasure information identifier of the countermeasure information determined to be effective for the abnormal state. The effective countermeasure information may be represented by a combination of a log information identifier of the log information indicating the abnormal state, a countermeasure information identifier of the countermeasure information determined to be effective for the abnormal state, and a degree of reduction of the abnormal state by the countermeasure information.

[0033] Furthermore, if the determined degree of reduction does not satisfy a second criterion (hereinafter referred to as abnormality resolution criterion), the countermeasure device 300 determines that the post-countermeasure log information also indicates an abnormal state, that is, the abnormal state has not been resolved. In this case, the countermeasure device 300 generates countermeasure information indicating a countermeasure for the abnormal state indicated by the post-countermeasure log information, and transmits the generated countermeasure information to the countermeasure receiving unit 121. The countermeasure information generated in this case may further include a log information identifier of the post-countermeasure log information.

[0034] In this way, when the countermeasure device 300 receives log information indicating an abnormal condition, it repeats generating and transmitting countermeasure information indicating countermeasures against the abnormal condition and determining the degree of mitigation of the abnormal condition until the degree of mitigation determined using the post-countermeasure log information satisfies the abnormality resolution criterion.

[0035] If the determined degree of reduction satisfies the anomaly resolution criterion, the countermeasure device 300 sends effective countermeasure information and information indicating the degree of reduction (hereinafter referred to as effect information) to the effect receiving unit 131. The countermeasure device 300 may set an effect concealment period indicating a period during which the effect information is concealed, for example, according to a predetermined rule for setting the effect concealment period, and generate effect information including effect concealment period information indicating the effect concealment period. The effect concealment period may be represented by the date and time at which the effect concealment period ends. In this case, the effect concealment period information is information indicating the date and time at which the effect concealment period ends.

[0036] <Notification destination device 400> The notification destination device 400 corresponds to the effect information provision target of the first embodiment. For example, when the effect information provision target is a device, the notification destination device 400 is the effect information provision target. When the effect information provision target is represented by an e-mail address, the notification destination device 400 is a device that receives e-mail addressed to the e-mail address that is the effect information provision target.

[0037] <Log reception unit 111> The log acceptance unit 111 accepts log information indicating the security state of the target device 200 from the target device 200. The log information of this embodiment includes the same information as the log information of the first embodiment. In this embodiment, log concealment period information indicating a period during which the log information is concealed is added to the log information sent from the target device 200. The log information may include the log concealment period information. The log acceptance unit 111 may add an identifier (hereinafter, referred to as a log information identifier) ​​to the accepted log information. The log concealment period information is determined by the target device 200. The log acceptance unit 111 sends the log information to the log notification unit 112. In addition, the log acceptance unit 111 stores the log information in the log storage unit 113. The log acceptance unit 111 may send the log information identifier of the accepted log information to the measure acceptance unit 121.

[0038] <Log notification unit 112> The log notification unit 112 receives log information from the log acceptance unit 111. The log notification unit 112 notifies the countermeasure device 300 of the received log information. In other words, the log notification unit 112 transmits the received log information to the countermeasure device 300.

[0039] <Log storage unit 113> The log information stored by the log storage unit 113 is stored.

[0040] <Countermeasures Reception Department 121> The countermeasure receiving unit 121 receives countermeasure information indicating a countermeasure for an abnormal state when the log information indicates an abnormal state from the countermeasure device 300. The countermeasure receiving unit 121 sends the received countermeasure information to the countermeasure notifying unit 122. In addition, the countermeasure receiving unit 121 stores the received countermeasure information in the countermeasure storage unit 123.

[0041] <Countermeasures Notification Division 122> The countermeasure notification unit 122 receives countermeasure information from the countermeasure reception unit 121. The countermeasure notification unit 122 notifies the target device of the received countermeasure information. In other words, the countermeasure notification unit 122 transmits the received countermeasure information to the target device.

[0042] <Countermeasures storage unit 123> The countermeasure storage unit 123 stores the countermeasure information stored by the countermeasure receiving unit 121 .

[0043] <Effects Reception Section 131> The effect receiving unit 131 receives, from the countermeasure device 300, the above-mentioned effect information indicating the effect of a countermeasure against an abnormal state indicated by the log information.

[0044] As described above, the effect information includes a log information identifier of log information indicating an abnormal state and a countermeasure information identifier of countermeasure information indicating a countermeasure for the abnormal state. The effect receiving unit 131 generates log information reference destination information indicating a reference destination of log information indicated by the log information identifier from the log information identifier. The reference destination of log information indicated by the log information identifier is information for reading out the log information specified by the log information identifier. The reference destination of log information may represent a request, a command, or a URI (Uniform Resource Identifier) ​​for reading out the log information. When the log reference destination information includes information on a storage destination of log information in the log storage unit 113, the effect receiving unit 131 may obtain information on the storage destination of the log information from the log receiving unit 111. The effect receiving unit 131 generates effect information reference destination information indicating a reference destination of effect information indicated by the effect information identifier from the effect information identifier. The reference destination of effect information indicated by the effect information identifier is information for reading out the effect information specified by the effect information identifier. The reference destination of the effect information may represent a request, a command, a URI, or the like for reading out the effect information. When the effect reference destination information includes information on the storage destination of the effect information in the effect storage unit 132, the effect receiving unit 131 may acquire the information on the storage destination of the effect information from the measure receiving unit 121.

[0045] The effect receiving unit 131 adds the generated log information reference destination information and effect information reference destination information to the received effect information. The effect receiving unit 131 stores the effect information to which the log information reference destination information and effect information reference destination information have been added in the effect storage unit 132. The effect receiving unit 131 may store effect information including the log information reference destination information and the effect information reference destination information in the effect storage unit 132, for example.

[0046] <Effects Memory Section 132> The effect storage unit 132 stores effect information.

[0047] <Effects Information Section 133> The effect information providing unit 133 provides the effect information stored in the effect storage unit 132 to a predetermined effect information providing target. When the effect information stored in the effect storage unit 132 includes effect concealment period information, the effect information providing unit 133 may provide the effect information to the predetermined effect information providing target when the concealment period indicated by the information concealment period information has elapsed.

[0048] The effect information providing unit 133 may transmit a list of effect information that can be provided, among the effect information stored in the effect storage unit 132, to the notification destination device 400. In this case, the list of effect information may be, for example, a list of effect reference destination information, which is information indicating a reference destination of the effect information. The reference destination of the effect information may represent a request, a command, or a URI (Uniform Resource Identifier), etc., for reading out the effect information. Then, the effect information providing unit 133 may receive a request for effect information using, for example, the effect reference destination information from the notification destination device 400, and transmit the effect information requested by the received request to the notification destination device 400.

[0049] <Log Information Providing Unit 114> The log information providing unit 114 receives a request for log information indicated by the log information reference destination information from the notification destination device 400. If the date and time of receiving the log information request is not within the log information concealment period of the log information indicated by the log information reference destination information, the log information providing unit 114 provides the log information indicated by the log information reference destination information to the notification destination device 400. In other words, if the date and time of receiving the log information request is later than the date and time at which the log information concealment period of the log information indicated by the log information reference destination information ends, the log information providing unit 114 provides the log information indicated by the log information reference destination information to the notification destination device 400. If the date and time of receiving the log information request is within the log information concealment period of the log information indicated by the log information reference destination information, the log information providing unit 114 does not provide the log information indicated by the log information reference destination information to the notification destination device 400. In other words, if the date and time when the request for log information is received is before the date and time when the log information concealment period of the log information indicated by the log information reference information ends, the log information providing unit 114 does not provide the log information indicated by the log information reference information to the notification destination device 400.

[0050] <Countermeasures Information Section 124> The countermeasure information providing unit 124 receives a request for countermeasure information indicated by the countermeasure information reference information from the notification destination device 400. If the date and time of receiving the request for countermeasure information is not within the countermeasure information concealment period of the countermeasure information indicated by the countermeasure information reference information, the countermeasure information providing unit 124 provides the countermeasure information indicated by the countermeasure information reference information to the notification destination device 400. In other words, if the date and time of receiving the request for countermeasure information is later than the date and time at which the countermeasure information concealment period of the countermeasure information indicated by the countermeasure information reference information ends, the countermeasure information providing unit 124 provides the countermeasure information indicated by the countermeasure information reference information to the notification destination device 400. If the date and time of receiving the request for countermeasure information is within the countermeasure information concealment period of the countermeasure information indicated by the countermeasure information reference information, the countermeasure information providing unit 124 does not provide the countermeasure information indicated by the countermeasure information reference information to the notification destination device 400. In other words, if the date and time when the request for countermeasure information is received is before the date and time when the countermeasure information concealment period of the countermeasure information indicated by the countermeasure information reference information ends, the countermeasure information providing unit 124 will not provide the countermeasure information indicated by the countermeasure information reference information to the notification destination device 400.

[0051] <Notification destination device 400> The notification destination device 400 may receive, for example, a list of effect information that can be provided from the effect information providing unit 133 and transmit a request for effect information included in the received list to the effect information providing unit 133.

[0052] The destination device 400 receives effect information from the effect information providing unit 133 and displays the received effect information. The destination device 400 transmits a request for log information indicated by the log information reference information to the log information providing unit 114 of the shared system 100, using the log information reference information included in the received effect information, in accordance with an instruction from the user of the destination device 400. When the destination device 400 receives log information from the log information providing unit 114 of the shared system 100, the destination device 400 displays the received log information. The destination device 400 transmits a request for countermeasure information indicated by the countermeasure information reference information to the countermeasure information providing unit 124 of the shared system 100, using the countermeasure information reference information included in the received effect information, in accordance with an instruction from the user of the destination device 400. When the destination device 400 receives countermeasure information from the countermeasure information providing unit 124 of the shared system 100, the destination device 400 displays the received countermeasure information.

[0053] <Operation> Next, the operation of the shared system according to the second embodiment of the present disclosure will be described in detail with reference to the drawings.

[0054] FIG. 4 is a flowchart showing an example of the operation of the shared system according to the second embodiment of the present disclosure. The operation shown in FIG. 4 is an operation of receiving log information, countermeasure information, and effect information. In the example shown in FIG. 4, first, the log receiving unit 111 receives log information from the target device 200 (step S101). Next, the log notification unit 112 notifies the countermeasure device 300 of the log information (step S102). Next, the countermeasure receiving unit 121 receives the countermeasure information from the countermeasure device 300 (step S103). The countermeasure notification unit 122 notifies the target device 200 of the countermeasure information (step 104). Then, the log receiving unit 111 receives post-countermeasure log information from the target device 200 (step S105). The log notification unit 112 notifies the countermeasure device 300 of the post-countermeasure log information (step S106).

[0055] Then, the shared system 100 receives information (countermeasure information or effect information) from the countermeasure device 300 (step S107). The countermeasure device 300 uses the received post-countermeasure log information to determine whether the abnormal condition represented by the log information has been resolved by the countermeasure represented by the countermeasure information. When the countermeasure device 300 determines that the abnormal condition represented by the log information has been resolved by the countermeasure represented by the countermeasure information, the countermeasure device 300 transmits effect information representing the effect of the countermeasure represented by the countermeasure information on the abnormal condition represented by the log information to the effect receiving unit 131. In this case, in step S107, the effect receiving unit 131 receives the effect information. When the countermeasure device 300 determines that the abnormal condition represented by the log information has not been resolved by the countermeasure represented by the countermeasure information, the countermeasure device 300 transmits countermeasure information representing another countermeasure on the abnormal condition represented by the log information to the countermeasure receiving unit 121. In this case, in step S107, the countermeasure receiving unit 121 receives the countermeasure information.

[0056] If the countermeasure receiving unit 121 receives countermeasure information ("Countermeasure Information" in step S108), the operation of the shared system 100 returns to step S104. If the effect receiving unit 131 receives effect information ("Effect Information" in step S108), the operation of the shared system 100 proceeds to step S109.

[0057] In step S109, the effect receiving unit 131 adds the log reference destination information and the countermeasure reference destination information to the effect information. Then, the effect receiving unit 131 stores the effect information to which the log reference destination information and the countermeasure reference destination information have been added (for example, the effect information including the log reference destination information and the countermeasure reference destination information) in the effect storage unit 132. Then, the shared system 100 ends the operation shown in FIG. 4.

[0058] Fig. 5 is a flowchart showing an example of the operation of the shared system 100 according to the second embodiment of the present disclosure. Fig. 5 shows an operation of providing effect information, log information, or effect information. The shared system 100 starts the operation shown in Fig. 5 when a request for information (i.e., effect information, log information, or effect information) is received.

[0059] 5, when the effect information providing unit 133 receives a request for effect information (YES in step S111), the effect information providing unit 133 provides the effect information (step S112). Then, the shared system 100 ends the operation shown in FIG.

[0060] When the effect information providing unit 133 does not accept a request for effect information (NO in step S111), the shared system 100 executes the operation from step S113. In this case, when the log information providing unit 114 accepts a request for log information (YES in step S113), the log information providing unit 114 specifies the log information concealment period of the log information for which the request has been accepted. Then, the log information providing unit 114 judges whether the date and time when the request for log information is accepted is within the log information concealment period of the log information. When the date and time when the log information is accepted is not within the log information concealment period of the log information (NO in step S114), the log information providing unit 114 provides the log information to the notification destination device 400 (step S115). Then, the shared system 100 ends the operation shown in FIG. 5. When the date and time when the log information is accepted is within the log information concealment period of the log information (YES in step S114), the shared system 100 ends the operation shown in FIG. 5.

[0061] In step S113, if the log information providing unit 114 does not accept the request for log information (NO in step S113), the shared system 100 performs the operations from step S116 onward. If the countermeasure information providing unit 124 accepts the request for countermeasure information (YES in step S116), the countermeasure information providing unit 124 identifies the countermeasure information concealment period of the countermeasure information for which the request was accepted. Then, the countermeasure information providing unit 124 judges whether the date and time when the request for countermeasure information was accepted is within the countermeasure information concealment period of the countermeasure information. If the date and time when the countermeasure information was accepted is not within the countermeasure information concealment period of the countermeasure information (NO in step S117), the countermeasure information providing unit 124 provides the countermeasure information to the notification destination device 400 (step S118). Then, the shared system 100 ends the operation shown in FIG. 5. If the date and time when the countermeasure information was accepted is within the countermeasure information concealment period of the countermeasure information (YES in step S117), the shared system 100 ends the operation shown in FIG. 5.

[0062] In step S116, if countermeasure information provider 124 has not received a request for countermeasure information (NO in step S116), shared system 100 ends the operation shown in FIG.

[0063] <Effects> The present embodiment described above has the same effects as the first embodiment, for the same reasons as those for the effects of the first embodiment.

[0064] <Third embodiment> Next, a third embodiment of the present disclosure will be described in detail with reference to the drawings.

[0065] <Configuration> FIG. 6 is a block diagram showing an example of the configuration of a countermeasure device according to the third embodiment of the present disclosure. In the example shown in FIG. 6, the countermeasure device 300 according to the present embodiment includes a log receiving unit 310, a countermeasure generating unit 320, a countermeasure providing unit 330, an effect determining unit 340, and an effect output unit 350. The log receiving unit 310 receives log information indicating a security state output from a target device. When the log information indicates an abnormal state, the countermeasure generating unit 320 generates countermeasure information indicating a countermeasure for the abnormal state. The countermeasure providing unit 330 provides the countermeasure information. The effect determining unit 340 determines the effect of the countermeasure from post-countermeasure log information, which is log information received after providing the countermeasure information. The effect output unit 350 outputs effect information indicating the effect. The countermeasure device 300 of the present embodiment has the same functions as the countermeasure device 300 of the second embodiment, and performs the same operation as the countermeasure device 300 of the second embodiment.

[0066] <Supplementary Information> In this embodiment, for example, the countermeasure providing unit 330 adds countermeasure concealment period information indicating a period during which the countermeasure information is concealed (hereinafter also referred to as countermeasure concealment period) to the countermeasure information generated by the countermeasure providing unit 330. For example, the countermeasure providing unit 330 outputs countermeasure information including the countermeasure concealment period information. The countermeasure providing unit 330 may set the countermeasure concealment period according to, for example, a predetermined rule for deciding the countermeasure concealment period. The countermeasure concealment period is the same as the countermeasure concealment period in the second embodiment.

[0067] Also, for example, the countermeasure generating unit 320 assigns an identifier (hereinafter, referred to as countermeasure information identifier) ​​to countermeasure information indicating a countermeasure for the abnormal state represented by the log information received by the log receiving unit 310. The countermeasure generating unit 320 adds the log information identifier of the received log information and the countermeasure information identifier of the countermeasure information indicating a countermeasure for the abnormal state represented by the log information to the countermeasure information. In other words, the countermeasure generating unit 320 generates countermeasure information indicating a countermeasure for the abnormal state represented by the received log information and including the log information identifier and the countermeasure information identifier of the log information. Then, the countermeasure providing unit 330 transmits the generated information to the countermeasure receiving unit 121.

[0068] Furthermore, the log receiving unit 310 receives log information after transmitting countermeasure information indicating a countermeasure for the abnormal state indicated by the received log information. The log information received after transmitting countermeasure information indicating a countermeasure for the abnormal state indicated by the received log information is referred to as post-countermeasure log information. The effect determining unit 340 determines the degree of mitigation of the abnormal state for which a countermeasure has been generated in the state indicated by the post-countermeasure log information received after transmitting the countermeasure information indicating the countermeasure.

[0069] If the determined degree of reduction does not satisfy the first criterion (hereinafter, referred to as the effective criterion), the effect determining unit 340 determines that the countermeasure indicated by the generated countermeasure information was not effective. In this case, the effect determining unit 340 may add countermeasure information indicating the countermeasure determined to be ineffective to the invalid countermeasure information. As described above, the invalid countermeasure information represents countermeasure information indicating the countermeasure determined to be ineffective for the abnormal state indicated by the log information. The invalid countermeasure information may be represented by, for example, a combination of the log information identifier of the log information indicating the abnormal state and the countermeasure information identifier of the countermeasure information determined to be ineffective for the abnormal state. Then, the effect output unit 350 generates countermeasure information representing other countermeasures for the abnormal state indicated by the log information, and transmits the generated countermeasure information to the countermeasure receiving unit 121.

[0070] If the determined degree of reduction satisfies a first criterion (i.e., an effective criterion), the effect determining unit 340 determines that the countermeasure indicated by the countermeasure information transmitted immediately before is effective. The effect determining unit 340 adds the countermeasure information indicating the countermeasure determined to be effective to the effective countermeasure information. As described above, the effective countermeasure information indicates the countermeasure information indicating the countermeasure determined to be effective for the abnormal state indicated by the log information. The effective countermeasure information may be represented, for example, by a combination of the log information identifier of the log information indicating the abnormal state and the countermeasure information identifier of the countermeasure information determined to be effective for the abnormal state. The effective countermeasure information may be represented by a combination of the log information identifier of the log information indicating the abnormal state, the countermeasure information identifier of the countermeasure information determined to be effective for the abnormal state, and the degree of reduction of the abnormal state by the countermeasure information.

[0071] Furthermore, if the determined degree of reduction does not satisfy a second criterion (hereinafter referred to as abnormality resolution criterion), the effect determining unit 340 determines that the post-countermeasure log information also indicates an abnormal state, that is, the abnormal state has not been resolved. In this case, the countermeasure generating unit 320 generates countermeasure information indicating a countermeasure for the abnormal state indicated by the post-countermeasure log information. Then, the countermeasure providing unit 330 transmits the generated countermeasure information to the countermeasure receiving unit 121. The countermeasure information generated in this case may further include a log information identifier of the post-countermeasure log information.

[0072] In this way, when the countermeasure device 300 receives log information indicating an abnormal condition, it repeats generating and transmitting countermeasure information indicating countermeasures against the abnormal condition and determining the degree of mitigation of the abnormal condition until the degree of mitigation determined using the post-countermeasure log information satisfies the abnormality resolution criterion.

[0073] When the degree of reduction determined by the effect determination unit 340 satisfies the anomaly resolution criterion, the effect output unit 350 sends effective countermeasure information and information indicating the degree of reduction (hereinafter referred to as effect information) to the effect receiving unit 131. The effect output unit 350 may set an effect concealment period indicating the period during which the effect information is concealed, for example, according to a predetermined rule for setting the effect concealment period, and generate effect information including effect concealment period information indicating the effect concealment period. The effect concealment period may be represented by the date and time when the effect concealment period ends. In this case, the effect concealment period information is information indicating the date and time when the effect concealment period ends.

[0074] <Operation> Next, the operation of the countermeasure device according to the third embodiment of the present disclosure will be described in detail with reference to the drawings.

[0075] Fig. 7 is a flowchart showing an example of the operation of the countermeasure device according to the third embodiment of the present disclosure. In the example shown in Fig. 7, first, the log receiving unit 310 receives log information (step S121). Next, the countermeasure generating unit 320 judges whether the log information indicates an abnormal state (step S122). If the log information does not indicate an abnormal state (NO in step S123), the countermeasure device 300 ends the operation shown in Fig. 7.

[0076] If the log information indicates an abnormal state (YES in step S123), countermeasure generation unit 320 generates countermeasure information (step S124). Then, countermeasure provision unit 330 provides the countermeasure information to countermeasure reception unit 121 of shared system 100 (step S125).

[0077] Next, the log receiving unit 310 receives the post-measure log information (step S126). Then, the effectiveness determining unit 340 determines whether the post-measure log information indicates an abnormal state (step S127). In step S127, the effectiveness determining unit 340 may determine the effectiveness of the countermeasure indicated by the provided countermeasure information in addition to determining whether the post-measure log information indicates an abnormal state.

[0078] If the post-countermeasure log information indicates an abnormal state (YES in step S128), the operation of the countermeasure device 300 returns to step S124. If the post-countermeasure log information does not indicate an abnormal state (NO in step S128), the effect determination unit 340 generates effect information (step S129). Then, the effect output unit 350 provides the effect information to the effect receiving unit 131 (step S130).

[0079] <Other embodiments> Each of the shared system 10, the shared system 100, and the countermeasure device 300 can be realized by a computer including a memory into which a program read from a storage medium is loaded, and a processor that executes the program. Each of the shared system 10, the shared system 100, and the countermeasure device 300 can also be realized by dedicated hardware such as a circuit. Each of the shared system 10, the shared system 100, and the countermeasure device 300 can also be realized by a combination of the above-mentioned computer and dedicated hardware.

[0080] FIG. 8 is a diagram showing an example of a hardware configuration of a computer 1000 that can realize a shared system and a countermeasure device according to an embodiment of the present disclosure. Referring to FIG. 8, the computer 1000 includes a processor 1001, a memory 1002, a storage device 1003, and an I / O (Input / Output) interface 1004. The computer 1000 can also access a storage medium 1005. The memory 1002 and the storage device 1003 are, for example, storage devices such as a RAM (Random Access Memory) and a hard disk. The storage medium 1005 is, for example, a storage device such as a RAM or a hard disk, a ROM (Read Only Memory), or a portable storage medium. The storage device 1003 may be the storage medium 1005. The processor 1001 can read and write data and programs from the memory 1002 and the storage device 1003. The processor 1001 can access, for example, other devices via the I / O interface 1004. The processor 1001 can access the storage medium 1005. The storage medium 1005 stores a program for causing the computer 1000 to operate as the shared system 10, a program for causing the computer 1000 to operate as the shared system 100, or a program for causing the computer 1000 to operate as the countermeasure device 300.

[0081] The processor 1001 loads a program, which is stored in the storage medium 1005 and causes the computer 1000 to operate as the shared system 10, into the memory 1002. The processor 1001 then executes the program loaded into the memory 1002, causing the computer 1000 to operate as the shared system 10.

[0082] The processor 1001 loads a program, which is stored in the storage medium 1005 and causes the computer 1000 to operate as the shared system 100, into the memory 1002. The processor 1001 then executes the program loaded into the memory 1002, causing the computer 1000 to operate as the shared system 100.

[0083] The processor 1001 loads a program, which is stored in a storage medium 1005 and causes the computer 1000 to operate as the countermeasure device 300, into the memory 1002. The processor 1001 then executes the program loaded into the memory 1002, causing the computer 1000 to operate as the countermeasure device 300.

[0084] The log reception unit 111, the log notification unit 112, the log information providing unit 114, the countermeasure reception unit 121, the countermeasure notification unit 122, the countermeasure information providing unit 124, the effect reception unit, and the effect information providing unit 133 can be realized, for example, by a processor 1001 that executes a program loaded in a memory 1002. The log storage unit 113, the countermeasure storage unit 123, and the effect storage unit 132 can be realized by a memory 1002 or a storage device 1003 such as a hard disk device included in the computer 1000. Some or all of the log reception unit 111, the log notification unit 112, the log information providing unit 114, the countermeasure reception unit 121, the countermeasure notification unit 122, the countermeasure information providing unit 124, the effect reception unit, the effect information providing unit 133, the log storage unit 113, the countermeasure storage unit 123, and the effect storage unit 132 can be realized by a dedicated circuit that realizes the function of each unit.

[0085] Furthermore, some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0086] (Appendix 1) a countermeasure receiving unit that receives countermeasure information from a countermeasure device that generates countermeasure information representing a countermeasure for an abnormal state when log information representing a security state of a target device indicates the abnormal state; a countermeasure notification unit that notifies the target device of the received countermeasure information; an effect receiving unit that receives the effect from the countermeasure device that determines the effect of the countermeasure against the abnormal state from log information after the countermeasure information is notified; an effect information providing unit for providing effect information indicating the effect to a predetermined effect information providing target; A shared system comprising:

[0087] (Appendix 2) The effect information providing unit receives the request for effect information, and if a source of the request for effect information is not included in the effect information providing targets, does not provide the effect information. 2. A shared system as described in appendix 1.

[0088] (Appendix 3) the effect information providing unit provides the effect information including countermeasure reference destination information indicating a reference destination of the countermeasure information of the countermeasure whose effect is represented by the effect information; a countermeasure request receiving unit that receives a request for the countermeasure information indicated by the countermeasure reference information; a countermeasure information providing unit that provides the countermeasure information to a sender of the request for the countermeasure information when the sender of the request for the countermeasure information is included in a predetermined countermeasure information providing target; 3. The shared system according to claim 1 or 2, comprising:

[0089] (Appendix 4) the countermeasure information includes a countermeasure concealment period indicating a period during which the countermeasure information is concealed; the countermeasure information providing unit does not provide the countermeasure information to a sender of the request for the countermeasure information when a time when the request for the countermeasure information is received is included in the countermeasure concealment period of the countermeasure information; 3. A shared system as described in Appendix 3.

[0090] (Appendix 5) the effect information providing unit provides the effect information including log reference destination information indicating a reference destination of the log information indicating the abnormal state in which the effect indicated by the effect information has occurred; a log request receiving unit that receives a request for the log information indicated by the log reference information; a log information providing unit that provides the log information to a sender of the request for the log information when the sender of the request for the log information is included in a predetermined log information providing target; 5. A sharing system according to any one of claims 1 to 4, comprising:

[0091] (Appendix 6) the log information includes a log concealment period indicating a period during which the log information is concealed; When a time when the log information request is received is included in the log concealment period of the log information, the log information providing unit does not provide the log information to a sender of the log information request. 6. A sharing system as described in appendix 5.

[0092] (Appendix 7) a log receiving unit that receives the log information from the target device; a log notification unit that notifies the countermeasure device of the log information; 7. A sharing system according to any one of claims 1 to 6, comprising:

[0093] (Appendix 8) a log receiving unit that receives log information indicating a security status output from a target device; a countermeasure generating unit that generates countermeasure information indicating a countermeasure for the abnormal state when the log information indicates the abnormal state; a countermeasure providing unit for providing the countermeasure information; an effect determining unit that determines an effect of the countermeasure from post-countermeasure log information that is log information received after the countermeasure information is provided; an effect sending unit that outputs effect information representing the effect; A countermeasure device equipped with the above.

[0094] (Appendix 9) The effect determining unit determines that the countermeasure has been effective when the log information after the countermeasure has been taken no longer indicates the abnormal state. 7. The countermeasure device according to claim 8.

[0095] (Appendix 10) the effect determination unit, when the post-measure log information indicates the abnormal state after a predetermined time has elapsed since the countermeasure information was provided, determines that the countermeasure was ineffective as an effect of the countermeasure, the countermeasure generation unit generates countermeasure information representing another countermeasure for the abnormal state when it is determined that the countermeasure is not effective; The countermeasure providing unit provides the countermeasure information representing other countermeasures for the abnormal state. 10. The countermeasure device according to claim 8 or 9.

[0096] (Appendix 11) receiving countermeasure information from a countermeasure device that generates countermeasure information representing a countermeasure for an abnormal state when log information representing a security state of the target device indicates the abnormal state; notifying the target device of the received countermeasure information; receiving the effect from the countermeasure device that determines the effect of the countermeasure against the abnormal state from log information after the countermeasure information is notified; providing effect information indicating the effect to a predetermined effect information recipient; How to share.

[0097] (Appendix 12) When the request for effect information is received and the sender of the request for effect information is not included in the subjects of effect information provision, the effect information is not provided. The sharing method described in Appendix 11.

[0098] (Appendix 13) providing the effect information including countermeasure reference information indicating a reference destination of the countermeasure information of the countermeasure whose effect is indicated by the effect information; receiving a request for the countermeasure information indicated by the countermeasure reference information; providing the countermeasure information to the sender of the request for the countermeasure information when the sender of the request for the countermeasure information is included in a predetermined target of the countermeasure information provision; 13. The sharing method according to claim 11 or 12.

[0099] (Appendix 14) the countermeasure information includes a countermeasure concealment period indicating a period during which the countermeasure information is concealed; If the time when the request for the countermeasure information is received is included in the countermeasure concealment period of the countermeasure information, the countermeasure information is not provided to the sender of the request for the countermeasure information. The sharing method described in Appendix 13.

[0100] (Appendix 15) providing the effect information including log reference information indicating a reference destination of the log information indicating the abnormal state in which the effect indicated by the effect information occurs; receiving a request for the log information indicated by the log reference information; When a source of the request for log information is included in a predetermined target of providing the log information, the source of the request for log information is provided with the log information. 15. A sharing method according to any one of claims 11 to 14.

[0101] (Appendix 16) the log information includes a log concealment period indicating a period during which the log information is concealed; If the time when the request for the log information is received is included in the log concealment period of the log information, the log information is not provided to the sender of the request for the log information. The sharing method described in Appendix 15.

[0102] (Appendix 17) receiving the log information from the target device; notifying the countermeasure device of the log information; 17. A sharing method according to any one of claims 11 to 16.

[0103] (Appendix 18) Receives log information indicating the security status output from the target device, If the log information indicates an abnormal state, generating countermeasure information indicating a countermeasure for the abnormal state; Provide the countermeasure information; determining the effectiveness of the countermeasure from post-countermeasure log information, which is log information received after providing the countermeasure information; outputting effect information representing the effect; Analysis method.

[0104] (Appendix 19) If the log information after the countermeasure is taken no longer indicates the abnormal state, it is determined that the countermeasure has been effective. Analytical method described in Appendix 18.

[0105] (Appendix 20) If the post-countermeasure log information indicates the abnormal state after a predetermined time has elapsed since the countermeasure information was provided, it is determined that the countermeasure was ineffective; generating countermeasure information representing another countermeasure for the abnormal condition if it is determined that the countermeasure was not effective; providing the countermeasure information representing other countermeasures for the abnormal condition; 20. The analytical method according to claim 18 or 19.

[0106] (Appendix 21) a countermeasure receiving process for receiving countermeasure information from a countermeasure device which generates countermeasure information representing a countermeasure for an abnormal state when log information representing a security state of a target device indicates the abnormal state; a countermeasure notification process for notifying the target device of the received countermeasure information; an effect receiving process for receiving the effect from the countermeasure device that determines the effect of the countermeasure for the abnormal state from log information after the countermeasure information is notified; an effect information providing process for providing effect information indicating the effect to a predetermined effect information providing target; A storage medium that stores a program that causes a computer to execute the above.

[0107] (Appendix 22) The effect information providing process receives a request for the effect information, and if a source of the request for the effect information is not included in the effect information providing targets, does not provide the effect information. 22. A storage medium as described in claim 21.

[0108] (Appendix 23) the effect information providing process provides the effect information including countermeasure reference destination information indicating a reference destination of the countermeasure information of the countermeasure whose effect is represented by the effect information; The program is a countermeasure request receiving process for receiving a request for the countermeasure information indicated by the countermeasure reference information; a countermeasure information providing process for providing the countermeasure information to a sender of the request for the countermeasure information when the sender of the request for the countermeasure information is included in a predetermined countermeasure information providing target; 23. A storage medium according to claim 21 or 22, which causes a computer to execute the above.

[0109] (Appendix 24) the countermeasure information includes a countermeasure concealment period indicating a period during which the countermeasure information is concealed; the countermeasure information providing process does not provide the countermeasure information to a sender of the request for the countermeasure information when a time when the request for the countermeasure information is received is included in the countermeasure concealment period of the countermeasure information; 24. A storage medium as described in claim 23.

[0110] (Appendix 25) the effect information providing process provides the effect information including log reference destination information indicating a reference destination of the log information indicating the abnormal state in which the effect indicated by the effect information has occurred; The program is a log request receiving process for receiving a request for the log information indicated by the log reference information; a log information providing process for providing the log information to a sender of the request for the log information when the sender of the request for the log information is included in a predetermined log information providing target; 25. A storage medium according to any one of claims 21 to 24, which causes a computer to execute the above.

[0111] (Appendix 26) the log information includes a log concealment period indicating a period during which the log information is concealed; the log information providing process does not provide the log information to a sender of the request for the log information when a time when the request for the log information is received is included in the log concealment period of the log information; 26. A storage medium as described in claim 25.

[0112] (Appendix 27) The program is a log reception process for receiving the log information from the target device; a log notification process for notifying the countermeasure device of the log information; 27. A storage medium according to any one of claims 21 to 26, which causes a computer to execute the above.

[0113] (Appendix 28) a log reception process for receiving log information indicating a security status output from a target device; a countermeasure generation process for generating countermeasure information indicating a countermeasure for the abnormal state when the log information indicates the abnormal state; a countermeasure provision process for providing the countermeasure information; an effect determination process for determining the effect of the countermeasure from post-countermeasure log information, which is log information received after the countermeasure information is provided; an effect sending process for outputting effect information representing the effect; A storage medium that stores a program that causes a computer to execute the above.

[0114] (Appendix 29) The effectiveness determination process determines that the countermeasure has been effective when the log information after the countermeasure has been taken no longer indicates the abnormal state. 29. The storage medium of claim 28.

[0115] (Appendix 30) The effectiveness determination process determines that the countermeasure was ineffective as an effect of the countermeasure when the post-countermeasure log information indicates the abnormal state after a predetermined time has elapsed since the countermeasure information was provided, the countermeasure generation process generates countermeasure information representing another countermeasure for the abnormal state when it is determined that the countermeasure is not effective; The countermeasure provision process provides the countermeasure information representing another countermeasure for the abnormal state. 30. A storage medium according to claim 28 or 29.

[0116] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. [Explanation of symbols]

[0117] 10. Shared Systems 100 Shared Systems 104 Steps 111 Log Reception Department 112 Log notification section 113 Log storage unit 114 Log Information Department 121 Countermeasures Reception Department 122 Countermeasures Notification Department 123 Countermeasures Memory Unit 124 Countermeasures Information Department 131 Effect Reception Department 132 Effect Memory Section 133 Efficacy Information Section 200 Target Device 300 Countermeasures Device 310 Log Reception Department 320 Countermeasure Generation Unit 330 Response Department 340 Effect Assessment Department 350 Effect Output Section 400 Notification destination device 1001 Processor 1002 Memory 1003 Storage device 1004 I / O Interface 1005 Storage medium

Claims

1. a countermeasure receiving means for receiving countermeasure information from a countermeasure device which generates countermeasure information representing a countermeasure for an abnormal state when log information representing a security state of a target device indicates the abnormal state; a countermeasure notification means for notifying the target device of the received countermeasure information; an effect receiving means for receiving the effect from the countermeasure device that judges the effect of the countermeasure against the abnormal state from log information after the countermeasure information is notified; an effect information providing means for providing effect information representing the effect to a predetermined effect information providing subject; A shared system comprising:

2. The effect information providing means receives the request for effect information, and when a source of the request for effect information is not included in the effect information providing targets, does not provide the effect information. The sharing system of claim 1 .

3. the effect information providing means provides the effect information including countermeasure reference information indicating a reference destination of the countermeasure information of the countermeasure whose effect is represented by the effect information; a countermeasure request receiving means for receiving a request for the countermeasure information indicated by the countermeasure reference information; a countermeasure information providing means for providing the countermeasure information to a sender of the request for the countermeasure information when the sender of the request for the countermeasure information is included in a predetermined target for providing the countermeasure information; The sharing system according to claim 1 or 2, comprising:

4. the countermeasure information includes a countermeasure concealment period indicating a period during which the countermeasure information is concealed; the countermeasure information providing means, when a time when the request for the countermeasure information is received is included in the countermeasure concealment period of the countermeasure information, does not provide the countermeasure information to a sender of the request for the countermeasure information; The sharing system according to claim 3 .

5. the effect information providing means provides the effect information including log reference destination information indicating a reference destination of the log information indicating the abnormal state in which the effect indicated by the effect information has occurred; a log request receiving means for receiving a request for the log information indicated by the log reference information; a log information providing means for providing the log information to a sender of the request for the log information when the sender of the request for the log information is included in a predetermined log information providing target; The sharing system according to any one of claims 1 to 4, comprising:

6. the log information includes a log concealment period indicating a period during which the log information is concealed; When the time when the request for the log information is received is included in the log concealment period of the log information, the log information providing means does not provide the log information to a sender of the request for the log information. The sharing system according to claim 5 .

7. a log receiving means for receiving the log information from the target device; a log notification means for notifying the countermeasure device of the log information; The sharing system according to any one of claims 1 to 6, comprising:

8. a log receiving means for receiving log information indicating a security status output from a target device; a countermeasure generating means for generating countermeasure information indicating a countermeasure for the abnormal state when the log information indicates the abnormal state; A countermeasure providing means for providing the countermeasure information; an effect determining means for determining an effect of the countermeasure from post-countermeasure log information, which is log information received after the countermeasure information is provided; an effect sending means for outputting effect information representing the effect; A countermeasure device equipped with the above.

9. The effectiveness determining means determines that the countermeasure has been effective when the log information after the countermeasure has been taken no longer indicates the abnormal state. The countermeasure device according to claim 8.

10. the effectiveness determination means determines that the countermeasure was ineffective as an effect of the countermeasure when the post-countermeasure log information indicates the abnormal state after a predetermined time has elapsed since the countermeasure information was provided, the countermeasure generating means generates countermeasure information representing another countermeasure for the abnormal state when it is determined that the countermeasure is not effective; The countermeasure providing means provides the countermeasure information representing other countermeasures for the abnormal state. The countermeasure device according to claim 8 or 9.

11. A computer comprising: receiving countermeasure information from a countermeasure device that generates countermeasure information representing a countermeasure for an abnormal state when log information representing a security state of the target device indicates the abnormal state; notifying the target device of the received countermeasure information; receiving the effect from the countermeasure device that determines the effect of the countermeasure against the abnormal state from log information after the countermeasure information is notified; providing effect information indicating the effect to a predetermined effect information recipient; How to share.

12. a countermeasure receiving process for receiving countermeasure information from a countermeasure device which generates countermeasure information representing a countermeasure for an abnormal state when log information representing a security state of a target device indicates the abnormal state; a countermeasure notification process for notifying the target device of the received countermeasure information; an effect receiving process for receiving the effect from the countermeasure device that determines the effect of the countermeasure for the abnormal state from log information after the countermeasure information is notified; an effect information providing process for providing effect information indicating the effect to a predetermined effect information providing target; A program that causes a computer to execute the following.

Images