ATTACK SCENARIO GENERATION DEVICE, ATTACK SCENARIO GENERATION METHOD, AND PROGRAM

Abstract

An attack scenario generation device 10 has: a first attack step detection unit 11 that executes an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used for representing a target system are stored and that detects a first attack step that satisfies a damage condition at which damage is inflicted on the first virtual model; an input / output condition extraction unit 12 that extracts, from the detected first attack step, an input condition or an output condition of the first virtual model, or both thereof; a second attack step detection unit 13 that executes an attack simulation on a second virtual model acquired from the storage device and that detects a second attack step that causes the output of the second virtual model to satisfy the input condition; and a combination unit 14 that generates an attack scenario by combining the first attack step and the second attack step.

Description

[Technical field]

[0001] The present invention relates to an attack scenario generation device and an attack scenario generation method for generating an attack scenario, and further relates to a program for implementing these. To Regarding. [Background technology]

[0002] There are known techniques for analyzing potential cyber-attack risks in systems. For example, there is known a technique for performing an attack simulation on a virtually constructed model of a system such as an OT (Operational Technology) or IoT (Internet of Things) system.

[0003] Patent Document 1 discloses a technology that comprehensively extracts possible attack paths when a cyber-attack is made on a target system, and derives attack examples (including, for example, attack content, countermeasures, etc.) for each device that constitutes each attack path.

[0004] According to the information processing device of Patent Document 1, first, an attack path is extracted based on a list of devices included in the system and a list of connections between the devices. Next, the information processing device of Patent Document 1 searches an attack example database in which past attack uses and node conditions are associated and stored, using the attack purposes and node (device) conditions of each device that constitutes the extracted attack path, and obtains attack examples corresponding to each device. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-185223 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, although the technology of Patent Document 1 derives attack examples, it is not a device that executes an attack simulation on a virtual model that imitates a target system and generates an attack scenario.

[0007] Furthermore, when a large-scale plant is the target system, if the large-scale plant includes many devices, a large capacity memory is required to execute an attack simulation on the above-mentioned virtual model, and the processing time of the attack simulation increases. Therefore, the processing time for generating an attack scenario also increases.

[0008] According to one aspect, an attack scenario generation device and an attack scenario generation method for reducing a processing time for generating an attack scenario, program To provide Located . [Means for solving the problem]

[0009] In order to achieve the above object, an attack scenario generation device according to one aspect comprises: a first attack step detection unit that executes an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detects a first attack step that satisfies a damage condition that causes damage to the first virtual model; an input / output condition extraction unit that extracts an input condition, an output condition, or both of the first virtual model from the detected first attack step; a second attack step detection unit that executes an attack simulation on a second virtual model acquired from the storage device and detects a second attack step in which an output of the second virtual model satisfies the input condition; and a combination unit that combines the first attack step and the second attack step to generate an attack scenario; The present invention is characterized by having the following.

[0010] In order to achieve the above object, a method for generating an attack scenario according to one aspect includes the steps of: The computer Executing an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detecting a first attack step that satisfies a damage condition that causes damage to the first virtual model; Extracting input conditions, output conditions, or both of the first virtual model from the detected first attack step; executing an attack simulation on the second virtual model acquired from the storage device, and detecting a second attack step in which an output of the second virtual model satisfies the input condition; generating an attack scenario by combining the first attack step and the second attack step; It is characterized by:

[0011] Furthermore, in order to achieve the above objective, M is , On the computer, Executing an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detecting a first attack step that satisfies a damage condition that causes damage to the first virtual model; extracting an input condition or an output condition, or both, of the first virtual model from the detected first attack step; executing an attack simulation on the second virtual model acquired from the storage device, and detecting a second attack step in which an output of the second virtual model satisfies the input condition; generating an attack scenario by combining the first attack step and the second attack step; child It is characterized by: Effect of the Invention

[0012] As one aspect, the processing time required to generate an attack scenario can be reduced. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram for explaining an example of a divided virtual model. [Diagram 2] FIG. 2 is a diagram illustrating an example of an attack scenario generation device. [Diagram 3] FIG. 3 is a diagram for explaining an example of the first attack step. [Figure 4] FIG. 4 is a diagram for explaining an example of the second attack step. [Diagram 5] FIG. 5 is a diagram for explaining the relationship between the virtual model and the first and second attack steps. [Figure 6] FIG. 6 is a diagram for explaining the relationship between the virtual model and the first and second attack steps. [Figure 7] FIG. 7 is a diagram for explaining an attack scenario. [Figure 8] FIG. 8 is a diagram illustrating an example of the operation of the attack scenario generation device. [Figure 9] FIG. 9 is a diagram illustrating an example of a system having an attack scenario generation device. [Figure 10] FIG. 10 is a diagram for explaining virtual models of different attack simulations. [Figure 11] FIG. 11 is a diagram for explaining the combination of attack steps in the second embodiment. [Figure 12] FIG. 12 is a diagram for explaining an example of the conversion table. [Figure 13] FIG. 13 is a diagram illustrating an example of the operation of the attack scenario generation device. [Figure 14] FIG. 14 is a diagram for explaining the third embodiment. [Figure 15] FIG. 15 is a diagram for explaining an attack scenario according to the third embodiment. [Figure 16] FIG. 16 is a block diagram illustrating an example of a computer that realizes the attack scenario generation device according to the first to third embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] First, an overview will be given to facilitate understanding of the embodiments described below. Since a large-scale plant consists of a large number of devices, when an attack simulation is performed on a virtual model of a large-scale plant (target system), the search space expands exponentially according to the number of devices. Also, the memory used for the attack simulation increases. Furthermore, the processing time of the attack simulation increases, i.e., the processing time for searching (generating) attack scenarios increases.

[0015] Therefore, the virtual model is divided and an attack simulation is performed on each divided virtual model.

[0016] Fig. 1 is a diagram for explaining an example of a divided virtual model. In the example of Fig. 1, a virtual model corresponding to a water storage system is divided, and the virtual model is represented using a plurality of models M1 and M2.

[0017] The model M1 is a model for controlling the water level of the tank T1. The model M1 has a controller PLC1, a sensor LS1, a valve V1, a valve V2, the tank T1, and a sensor PS1, which represent the functions of each device.

[0018] The model M2 is a model for controlling the water level of the tank T2. The model M2 has a controller PLC2, a sensor LS2, a tank T2, and a sensor PS1, which represent the functions of each device.

[0019] Here, the sensor PS1 is a sensor that measures the flow rate (flowing / not flowing: On / Off) of water flowing through a pipe connecting the tank T1 and the tank T2. The sensor PS1 is also related to both the model M1 and the model M2.

[0020] The controller PLC1 controls the opening / closing (Open / Closed) of the valves V1 and V2 based on the water level of the tank T1 measured by a sensor LS1 that measures the water level of the tank T1. In the example of Fig. 1, the sensor LS1 measures six levels (Low-Low, Low, Middle, High, High-High, Overflow).

[0021] The controller PLC2 transmits the water level of the tank T2 measured by the sensor LS2 that measures the water level of the tank T2 to the controller PLC1.

[0022] Thereafter, the controller PLC1 receives the water level of the tank T2 from the controller PLC2, and controls the opening and closing of the valve V2 based on the received water level of the tank T2.

[0023] As shown in the example in Figure 1, by dividing the model into models M1 and M2, the number of devices included in each of the models M1 and M2 can be reduced. Therefore, the total processing time for the attack simulation of each of the models M1 and M2 can be shorter than the processing time when the attack simulation is performed on a virtual model that is not divided.

[0024] However, because the control loop of a divided virtual model is not necessarily closed, it affects other virtual models and is affected by other virtual models. In the example of Figure 1, the divided models M1 and M2 also affect each other.

[0025] Therefore, (1) simply running an attack simulation on each divided virtual model does not allow for inclusion of the impact, making it difficult to explore attack scenarios that can be obtained by running an attack simulation on a non-divided virtual model.

[0026] Furthermore, (2) if the description format for describing the device state differs for each divided virtual model, it is difficult to search for attack scenarios that can be obtained by performing attack simulations on a virtual model that is not divided.

[0027] Through this process, the inventor discovered the problems (1) and (2) that arise when searching for attack scenarios using a divided virtual model as described above, and also came up with a means for solving the problems.

[0028] That is, the inventor has derived a means for searching for an attack scenario using a divided virtual model. As a result, the processing time for searching for an attack scenario can be shortened and the increase in memory used for attack simulation can be suppressed.

[0029] Hereinafter, an embodiment will be described with reference to the drawings. In the drawings described below, elements having the same or corresponding functions are denoted by the same reference numerals, and repeated description thereof may be omitted.

[0030] (Embodiment 1) The configuration of the attack scenario generating device in the embodiment 1 will be described with reference to Fig. 2. Fig. 2 is a diagram for explaining an example of the attack scenario generating device.

[0031] [Device configuration] The attack scenario generation device 10 executes an attack simulation for each divided virtual model and generates an attack scenario by combining the attack steps of each divided virtual model, thereby shortening the processing time for generating an attack scenario and suppressing an increase in memory used for the attack simulation.

[0032] The attack simulation may be a general attack simulation, or a different attack simulation may be used for each divided virtual model.

[0033] As shown in FIG. 2, the attack scenario generation device 10 includes a first attack step detection unit 11, an input / output condition extraction unit 12, a second attack step detection unit 13, and a combination unit .

[0034] The attack scenario generation device 10 is, for example, an information processing device such as a CPU (Central Processing Unit), a programmable device such as an FPGA (Field-Programmable Gate Array), or a GPU (Graphics Processing Unit), or a circuit equipped with one or more of these, a server computer, a computer, a mobile terminal, or the like.

[0035] The first attack step detection unit 11 executes an attack simulation on a first virtual model obtained from a storage device (not shown) in which multiple divided virtual models used to represent a target system are stored, and detects a first attack step that satisfies a damage condition that causes damage to the first virtual model.

[0036] Specifically, first, the first attack step detection unit 11 acquires a first virtual model from a storage device. Next, the first attack step detection unit 11 executes an attack simulation to search for a first attack step that satisfies the damage condition on the first virtual model. Next, the first attack step detection unit 11 acquires the first attack step that satisfies the damage condition as a result of the attack simulation, and stores the first attack step in the storage device.

[0037] The storage device stores virtual models obtained by dividing the target system. In the example of Fig. 1, models M1 and M2 are stored. The storage device may be provided inside or outside the attack scenario generation device 10.

[0038] The virtual model is information that represents the state of the device in a predetermined description format, such as a text format.

[0039] The damage condition is information that indicates damage to the target system when a cyber attack is carried out. For example, the damage condition in the target system in FIG. 1 is that water overflows from the tank T2 of the model M2.

[0040] The first attack step is information representing the change in the state of each device included in the first virtual model until an attack simulation is performed on the first virtual model and the first virtual model reaches a state where the damage condition is satisfied.

[0041] Fig. 3 is a diagram for explaining an example of the first attack step. The first attack steps 31 and 32 shown in Fig. 3 are the results obtained by executing an attack simulation to search for a first attack step that satisfies the damage condition on the model M2.

[0042] Specifically, the first attack step 31 is a result obtained by executing an attack simulation on a model M2 in a normal state under a damage condition that the tank T2 overflows (T2=Overflow). Also, the first attack step 32 is a result obtained by executing an attack simulation on a model M2 in a normal state under a damage condition that the tank T2 overflows (T2=Overflow), assuming an abnormal state of the sensor LS2 (equipment) of the model M2.

[0043] The input / output condition extraction unit 12 extracts input conditions for the first virtual model from the detected first attack step. and Output Condition The matter Specifically, first, the input / output condition extraction unit 12 acquires a first attack step from the storage device. Next, the input / output condition extraction unit 12 uses the first attack step to extract input conditions of the first virtual model. and Output Condition The matter Extract.

[0044] The input condition is information that represents the state, in the first attack step, of devices included in the target virtual model that have been set in advance as input devices.

[0045] The output condition is information that indicates the state, in the first attack step, of a device that is included in the target virtual model and that has been set in advance as an output device.

[0046] The input conditions for the first attack steps 31 and 32 will now be described. Because water is supplied to the tank T2 of model M2 from the tank T1 of model M1, the state of the sensor PS1 in front of the tank T2, i.e., whether or not the flow of water is measured, becomes the input condition for model M2. Therefore, in the case of the first attack steps 31 and 32, the state in which the sensor PS1 measures the flow of water (PS1=On) becomes the input condition for model M2.

[0047] We will now explain the output conditions of the first attack steps 31 and 32. The controller PLC2 of the model M2 transmits the water level of the tank T2 measured by the sensor LS2 to the controller PLC1 of the model M1, so the state of the sensor LS2 transmitted by the controller PLC2 becomes the output condition of the model M2.

[0048] Therefore, in the first attack step 31, the state of the sensor LS2 (PLC2.LS2=High--High) transmitted by the controller PLC2 becomes the output condition of the model M2. Also, in the first attack step 32, the state of the sensor LS2 (PLC2.LS2=Low) transmitted by the controller PLC2 to the controller PLC1 becomes the output condition of the model M2.

[0049] The second attack step detection unit 13 executes an attack simulation on a second virtual model related to the first virtual model, and detects, as an output of the second virtual model, a second attack step that satisfies the input conditions extracted from the first attack step.

[0050] Specifically, first, the second attack step detection unit 13 acquires a second virtual model from a storage device. Next, the second attack step detection unit 13 sets the input of the second virtual model. Next, the second attack step detection unit 13 executes an attack simulation that satisfies the input conditions extracted from the first attack step on the second virtual model. Next, the second attack step detection unit 13 acquires a second attack step that satisfies the input conditions as a result of the attack simulation, and stores the second attack step in a storage device (not shown).

[0051] The second attack step is information that represents the change in the state of each device included in the second virtual model until an attack simulation that satisfies the input conditions is executed on the second virtual model and a state that satisfies the input conditions is reached.

[0052] Fig. 4 is a diagram for explaining an example of the second attack step. The second attack steps 41 and 42 shown in Fig. 4 are the results obtained by setting the output conditions of the model M2 as the input of the model M1 and executing an attack simulation to search for a second attack step that satisfies the input conditions of the model M2 as the output of the model M1. Note that in the second attack step 41, some of the states of the equipment in the step are omitted.

[0053] 5 and 6 are diagrams for explaining the relationship between the virtual model and the first and second attack steps. To detect the second attack step 41 in Fig. 4, first, the state of the sensor LS2 (PLC2.LS2=High-High) transmitted from the controller PLC2 to the controller PLC1, which is the output condition extracted from the first attack step 31, is set as the input of the model M1.

[0054] Next, an attack simulation is performed on the model M1 in the normal state, satisfying the state where the sensor PS1 measures the water flow (PS1=On) with the input condition extracted from the first attack step 31 as the output. As a result, a second attack step 41 is obtained.

[0055] However, in the case of the second attack step 41, the sensor PS1 of the model M2 does not go into the open state (PS1=On), so the second attack step 41 is not selected.

[0056] Next, to detect the second attack step 42 in FIG. 4, first, the state of sensor LS2 (PLC2.LS2=Low) transmitted by controller PLC2 to controller PLC1, which is the output condition extracted from the first attack step 32, is set as the input of model M1.

[0057] Next, an attack simulation is performed on the model M1 in the normal state, satisfying the state where the sensor PS1 measures the water flow (PS1=On) with the input condition extracted from the first attack step 32 as the output. As a result, a second attack step 42 is obtained.

[0058] In the case of the second attack step 42, the sensor PS1 of the model M2 is in the open state (PS1=On), that is, the input and output conditions for causing damage to the model M2 are satisfied, so the second attack step 42 is selected. In other words, by tampering with the state of the sensor LS2 to set PLC2.LS2=Low, the sensor PS1 is in the open state (PS1=On), causing damage to the model M2.

[0059] The combining unit 14 combines the first attack step and the second attack step to generate an attack scenario. Specifically, the combining unit 14 first combines the first attack step and the attack step extracted in the first attack step. input The combining unit 14 obtains the first attack step 32 and the second attack step 42 that satisfy the condition and the output condition from the storage device. For example, the combining unit 14 obtains the first attack step 32 and the second attack step 42.

[0060] Next, the combining unit 14 combines the first attack step and the second attack step to generate an attack scenario. Fig. 7 is a diagram for explaining the attack scenario. The attack scenario shown in Fig. 7 combines the first attack step 32 and the second attack step 42. Specifically, since the state of the sensor LS2 (PLC2.LS2=Low) is the same in the first attack step 32 and the second attack step 42, they are combined based on the state of the sensor LS2.

[0061] [Device operation] Next, the operation of the attack scenario generation device in embodiment 1 will be described with reference to FIG. 8. FIG. 8 is a diagram for explaining an example of the operation of the attack scenario generation device. In the following description, the diagram will be referred to as appropriate. Furthermore, in embodiment 1, the attack scenario generation method is implemented by operating the attack scenario generation device. Therefore, the description of the attack scenario generation method in embodiment 1 will be replaced with the description of the operation of the attack scenario generation device below.

[0062] As shown in Fig. 8, first, the first attack step detection unit 11 acquires a first virtual model from a storage device (step A1). Next, the first attack step detection unit 11 executes an attack simulation to search for a first attack step that satisfies the damage condition on the first virtual model (step A2). Next, the first attack step detection unit 11 acquires a first attack step that satisfies the damage condition as a result of the attack simulation, and stores the first attack step in the storage device.

[0063] Next, the input / output condition extraction unit 12 extracts the input conditions of the first virtual model by using the first attack step acquired from the storage device. and Output Condition The matter Extract (Step A3).

[0064] Next, the second attack step detection unit 13 acquires a second virtual model from the storage device (step A4). Next, the second attack step detection unit 13 sets the input of the second virtual model (step A5). Next, the second attack step detection unit 13 executes an attack simulation that satisfies the input conditions extracted from the first attack step on the second virtual model (step A6). Next, the second attack step detection unit 13 acquires a second attack step that satisfies the input conditions as a result of the attack simulation, and stores the second attack step in a storage device (not shown).

[0065] Next, the bond 14 is subjected to a first attack step and inputThe second attack step that satisfies the condition and the output condition is obtained from the storage device (step A7). Next, the combining unit 14 combines the first attack step and the second attack step to generate an attack scenario (step A8).

[0066] If there are other divided models, the above-mentioned steps A1 to A8 are repeated to generate attack scenarios.

[0067] [Effects of the First Embodiment] In large-scale plants, the number of devices that make up the plant is large, so if an attack simulation is performed on a virtual model that virtualizes a large-scale plant, a large amount of memory is required and the processing time of the attack simulation increases, i.e., the processing time for generating an attack scenario also increases.

[0068] However, in the first embodiment, the virtual model of the target system is divided and the attack simulation is performed using the divided virtual models, so that the memory usage can be reduced compared to the case where the attack simulation is performed on the entire target system.

[0069] In addition, in embodiment 1, the virtual model is divided, an attack simulation is performed for each divided virtual model, and an attack scenario is generated based on the execution results (first attack step and second attack step), thereby shortening the processing time for generating the attack scenario.

[0070] In addition, by repeating the above-mentioned process until the initial attack steps of a cyber attack are discovered, it is possible to generate an attack scenario from the intrusion into the target system to the occurrence of damage.

[0071] Furthermore, multiple attack steps may be generated in parallel, for example attack simulations may be performed in parallel.

[0072] (Embodiment 2) The configuration of a system including the attack scenario generation device in embodiment 2 will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of a system including the attack scenario generation device.

[0073] [System Configuration] As shown in FIG. 9, the system 100 in the second embodiment includes an attack scenario generation device 10, an input device 20, a storage device 30, an attack simulation device 40, and an output device 50.

[0074] The attack scenario generation device 10 has a first attack step detection unit 11, an input / output condition extraction unit 12, a second attack step detection unit 13, a combination unit 14, as well as a conversion unit 15 and an output information generation unit 16.

[0075] The input device 20 is a device for inputting settings such as damage conditions, etc. Examples of the input device include a keyboard, a mouse, and a touch panel.

[0076] The storage device 30 stores virtual models (first virtual model, second virtual model) obtained by dividing the target system, first attack steps, second attack steps, input conditions, output conditions, attack scenarios, various setting parameters, etc. The storage device 30 is, for example, a database or a server computer. Note that, in the example of FIG. 9, the storage device 30 is provided outside the attack scenario generation device 10, but it may also be provided inside. The storage device 30 may also be divided into multiple storage devices.

[0077] The attack simulation device 40 is a device that executes an attack simulation to search for a first attack step and a second attack step. The attack simulation device 40 is, for example, a device in which an attack simulator is installed in a server computer or the like. In the example of Fig. 9, the attack simulation device 40 is provided outside the attack scenario generation device 10, but it may also be provided inside.

[0078] The output device 50 acquires the output information converted into an outputtable format by the output information generating unit 16, and outputs the generated image and sound based on the output information. The output device 50 is, for example, an image display device using a liquid crystal, an organic EL (Electro Luminescence), or a CRT (Cathode Ray Tube). Furthermore, the image display device may include an audio output device such as a speaker. The output device 50 may also be a printing device such as a printer.

[0079] The attack scenario generation device will now be described in detail. The first attack step detection unit 11, the input / output condition extraction unit 12, the second attack step detection unit 13, and the combination unit 14 have already been explained, so their explanation will be omitted.

[0080] When the type of attack simulation is different, the conversion unit 15 converts the input conditions and output conditions into descriptions according to the type of attack simulation.

[0081] Description conversion will now be described. 10 is a diagram for explaining a virtual model of a different attack simulation, which further includes a model M3 in addition to the above-mentioned models M1 and M2.

[0082] Model M3 has a computer PC, server computers SV1, SV2, and SV3, gateways GW1 and GW2, an engineering workstation EWS, and a SCADA (Supervisory Control And Data Acquisition: a system that performs system monitoring and process control by a computer), which represent the functions of each device. Also, model M3 uses a different type of attack simulation from models M1 and M2.

[0083] 11 is a diagram for explaining the combination of attack steps in embodiment 2. The description of attack step S3 of model M3 is different from the description of attack step S2 of model M1 and attack step S1 of model M2. Therefore, the combination unit 14 cannot combine attack step S3 with attack step S2 and attack step S1.

[0084] Attack step S1 shown in FIG. 11 is information representing the change in state of each device included in model M2 until model M2 reaches a state where an attack simulation is performed on model M2 and the damage condition (T2=Overflow) is satisfied.

[0085] Attack step S2 shown in FIG. 11 is information representing changes in the state of each device included in model M1 until an attack simulation is performed on model M1 and a state is reached that satisfies the input condition (PS=On) of model M2.

[0086] The attack step S3 shown in Fig. 11 is information that represents the change in the state of each device included in the model M3 until the state where the input condition (PLC1 = Remote exploit / PLC1.V2 = Compromised) of the model M1 is satisfied by executing an attack simulation on the model M3. Note that in the attack step S3, some of the device states in the steps are omitted.

[0087] In addition, the input condition of the attack step S2 in Fig. 11, "PLC1.V2=Compromised", indicates a state in which an attacker can perform unauthorized operations (such as tampering with sensor values ​​and operations) on the controller PLC1. Therefore, in the attack step S3 in Fig. 11, a condition "Remote exploit" is set, which indicates that unauthorized operations are possible on the controller PLC1, and an attack simulation is performed.

[0088] The expression of unauthorized operation differs depending on the method of attack simulation, so it is sufficient to set something that means the same state. In the second embodiment, "Remote exploit" is set, but other things may be used as long as they indicate a state in which unauthorized operation is possible. For example, "Local exploit" (unauthorized operation is possible by some kind of attack after logging in to the target) may be specified.

[0089] Specifically, the conversion unit 15 determines whether the type of attack simulation of the attack step is different. If the type of attack simulation of the attack step is different, the conversion unit 15 converts the description of the input condition and the output condition included in the attack step to be converted into the description of the attack simulation to be converted, using the conversion information.

[0090] Fig. 12 is a diagram for explaining an example of a conversion table. Conversion information 131 in Fig. 12 is a conversion table in which equivalent descriptions are associated with each other in two attack simulations. Conversion information 132 in Fig. 12 is a conversion table in which equivalent descriptions are associated with each other for each device in two attack simulations.

[0091] Conversion information 131 and 132 in FIG. 12 is information that associates a "conversion rule number," "pre-conversion type," "pre-conversion condition," "post-conversion type," and "post-conversion condition." The conversion rule numbers "1" to "4" are information for identifying the conversion rule. The pre-conversion type and post-conversion type "A" and "B" are information for identifying the type of attack simulation. In addition, the device IDs "HMI," "EWS," "V1," "V2," "LS," and "PLC" in the conversion information 132 in FIG. 12 are information for identifying the devices.

[0092] The pre-conversion condition is information that represents the input condition and output condition before conversion. The post-conversion condition is information that represents the input condition and output condition after conversion. For example, when the pre-conversion condition "Remote exploit" of the conversion rule number "2" in the conversion information 131 is converted, it is converted to the post-conversion condition "Compromised".

[0093] The combination of attack steps S1, S2, and S3 will now be described. first, attack As described in the first embodiment, the attack step S2 and the attack step S1 are combined using the combining unit 14. Specifically, since the state of the sensor PS1 (PS1=On) is the same in the attack step S2 and the attack step S1, they are combined based on the state of the sensor PS1.

[0094] Next, the combining unit 14 combines the output (PLC1=Remote exploit) of the controller PLC1 in the attack step S3 and the input (PLC1=Compromised) of the controller PLC1 in the attack step S2. When the output (PLC1=Remote exploit) of the controller PLC1 in the attack step S3 is converted, it becomes the same description as PLC1=Compromised, which is the input condition of the model M1, so it combines based on PLC1=Compromised.

[0095] In this manner, the combining unit 14 combines the attack steps S1, S2, and S3 to generate an attack scenario.

[0096] The output information generation unit 16 generates output information for displaying, for example, at least one of the entire virtual model of the target system, the divided virtual models, the attack steps, the attack scenarios, the damage conditions, the input conditions, and the output conditions on the output device 50.

[0097] [Device operation] Next, the operation of the attack scenario generation device in embodiment 2 will be described with reference to FIG. 13. FIG. 13 is a diagram for explaining an example of the operation of the attack scenario generation device. In the following description, the diagram will be referred to as appropriate. Furthermore, in embodiment 2, the attack scenario generation method is implemented by operating the attack scenario generation device. Therefore, the description of the attack scenario generation method in embodiment 2 will be replaced with the description of the operation of the attack scenario generation device below.

[0098] The difference between the first and second embodiments is steps B1 and B2. Steps A1 to A8 have been explained in the first embodiment, so the explanation of steps A1 to A8 will be omitted.

[0099] In step B1, when the type of attack simulation is different, the conversion unit 15 converts the input conditions and output conditions into descriptions according to the type of attack simulation.

[0100] In step B2, the output information generation unit 16 generates output information for displaying, on the output device 50, for example, at least one of the entire virtual model, the divided virtual models, the attack steps, the attack scenarios, the damage conditions, the input conditions, and the output conditions.

[0101] [Effects of the second embodiment] According to the second embodiment, in addition to the same effects as those of the first embodiment, the descriptions of input conditions and output conditions can be converted, so that different attack simulations can be combined to generate attack scenarios.

[0102] (Embodiment 3) Fig. 14 is a diagram for explaining the embodiment 3. The virtual model in Fig. 14 has models M4 and M5.

[0103] Model M4 has an intrusion entrance Attacker, gateways GW1 and GW2, and a server computer SV1, which represent the functions of each device, etc. Model M5 has a gateway GW2, a computer PC1, and server computers SV4, SV5, and SV6.

[0104] In the third embodiment, first, the first attack step detection unit 11 executes an attack simulation on the model M5 to detect an attack step S5 that satisfies a damage condition (SV6=Data-inject) that inflicts damage on the model M5.

[0105] Next, the input / output condition extraction unit 12 extracts an input condition (PC1=Local exploit) of the model M5 from the detected attack step S5.

[0106] Next, the second attack step detection unit 13 executes an attack simulation on a model M4 related to the model M5 using the input condition (PC1 = Local exploit) extracted from the attack step S5 as input, and detects an attack step S4 that satisfies the input condition extracted from the attack step S5 as the output of the model M4.

[0107] Fig. 15 is a diagram for explaining an attack scenario of the third embodiment. In the description of the attack step S4 of the model M4, first, an attacker transmits unauthorized data from the intrusion point Attacker to the server computer SV1 via the gateway GW1 (injection attack: Data-inject). Next, the unauthorized data is transferred from the server computer SV1 to the computer PC via the gateway GW2. After that, when the unauthorized data is opened by the computer PC1, it is infected with malware (Local exploit).

[0108] In addition, in the description of the attack step S5 of the model M5, first, the computer PC1 attacks the server computer SV4. Next, the server computer SV4 registers unauthorized data in the server computer SV6. Note that in the attack steps S4 and S5, some of the states of the devices in the steps are omitted.

[0109] The combining unit 14 combines the attack step S4 and the attack step S5 to generate an attack scenario. Specifically, the output (PC1=Local exploit) of the computer PC1 in the attack step S4 is the same as the input (PC1=Local exploit) of the computer PC1 in the attack step S5, so they are combined.

[0110] [Effects of the third embodiment] According to the third embodiment, it is possible to obtain the same effects as those of the first embodiment.

[0111] [program] The program in the first to third embodiments may be a program that causes a computer to execute steps A1 to A8 shown in Fig. 8, or steps A1 to A8, B1, and B2 shown in Fig. 13. By installing and executing this program in a computer, the attack scenario generation device and attack scenario generation method in the first to third embodiments can be realized. In this case, the processor of the computer functions as a first attack step detection unit 11, an input / output condition extraction unit 12, a second attack step detection unit 13, a combination unit 14, a conversion unit 15, and an output information generation unit 16, and performs processing.

[0112] The programs in the first to third embodiments may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the first attack step detection unit 11, the input / output condition extraction unit 12, the second attack step detection unit 13, the combination unit 14, the conversion unit 15, and the output information generation unit 16.

[0113] [Physical configuration] Here, a computer that realizes the attack scenario generation device by executing the program according to the first to third embodiments will be described with reference to Fig. 16. Fig. 16 is a block diagram showing an example of a computer that realizes the attack scenario generation device according to the first to third embodiments of the present invention.

[0114] 16, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other. The computer 110 may include a GPU or an FPGA in addition to the CPU 111 or instead of the CPU 111.

[0115] The CPU 111 loads the programs (codes) in this embodiment stored in the storage device 113 into the main memory 112 and executes them in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). The programs in this embodiment are provided in a state stored in a computer-readable recording medium 120. The programs in this embodiment may be distributed on the Internet connected via the communication interface 117. The recording medium 120 is a non-volatile recording medium.

[0116] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0117] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0118] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0119] The attack scenario generation device 10 in the first to third embodiments can be realized not by a computer with a program installed, but by using hardware corresponding to each part. Furthermore, the attack scenario generation device 10 may be partially realized by a program and the remaining part by hardware.

[0120] [Note] The following supplementary notes are further disclosed regarding the above-described embodiments. A part or all of the above-described embodiments can be expressed by (Supplementary Note 1) to (Supplementary Note 9) described below, but are not limited to the following descriptions.

[0121] (Appendix 1) a first attack step detection unit that executes an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detects a first attack step that satisfies a damage condition that causes damage to the first virtual model; an input / output condition extraction unit that extracts an input condition, an output condition, or both of the first virtual model from the detected first attack step; a second attack step detection unit that executes an attack simulation on a second virtual model acquired from the storage device and detects a second attack step in which an output of the second virtual model satisfies the input condition; and a combination unit that combines the first attack step and the second attack step to generate an attack scenario; An attack scenario generation device having the above configuration.

[0122] (Appendix 2) 2. An attack scenario generation device according to claim 1, a conversion unit that converts the input condition and the output condition into descriptions according to the type of the attack simulation when the type of the attack simulation is different. An attack scenario generation device having the above configuration.

[0123] (Appendix 3) 3. An attack scenario generation device according to claim 1, A plurality of the first and second attack steps are generated in parallel. Attack scenario generator.

[0124] (Appendix 4) The computer a first attack step detection step of executing an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detecting a first attack step that satisfies a damage condition that causes damage to the first virtual model; an input / output condition extraction step of extracting an input condition, an output condition, or both of the first virtual model from the detected first attack step; a second attack step detection step of executing an attack simulation on a second virtual model acquired from the storage device and detecting a second attack step in which an output of the second virtual model satisfies the input condition; a combining step of combining the first attack step and the second attack step to generate an attack scenario; The attack scenario generation method includes the steps of:

[0125] (Appendix 5) 5. The attack scenario generation method according to claim 4, further comprising: The computer, a conversion step in which, if the type of the attack simulation is different, the input condition and the output condition are converted into descriptions corresponding to the type of the attack simulation. The attack scenario generation method includes the steps of:

[0126] (Appendix 6) 6. The attack scenario generation method according to claim 4, further comprising: A plurality of the first and second attack steps are generated in parallel. Method for generating attack scenarios.

[0127] (Appendix 7) On the computer, a first attack step detection step of executing an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detecting a first attack step that satisfies a damage condition that causes damage to the first virtual model; an input / output condition extraction step of extracting an input condition, an output condition, or both of the first virtual model from the detected first attack step; a second attack step detection step of executing an attack simulation on a second virtual model acquired from the storage device and detecting a second attack step in which an output of the second virtual model satisfies the input condition; a combining step of combining the first attack step and the second attack step to generate an attack scenario; A program that contains instructions to execute Hmm.

[0128] (Appendix 8) As described in Appendix 7 program And, The program causes the computer to a conversion step in which, if the type of the attack simulation is different, the input condition and the output condition are converted into descriptions corresponding to the type of the attack simulation. A program that contains instructions to execute Hmm.

[0129] (Appendix 9) The following items are listed in Appendix 7 or 8: program And, A plurality of the first and second attack steps are generated in parallel. Program Hmm.

[0130] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Industrial Applicability]

[0131] As described above, according to the present invention, the processing time required for generating an attack scenario can be shortened, and the present invention is useful in fields where the generation of an attack scenario is required. [Explanation of symbols]

[0132] 10. Attack scenario generator 11 First attack step detection section 12 Input / Output Condition Extraction Section 13 Second attack step detection section 14 Joint 15 Conversion section 16 Output information generation unit 20 Input Devices 30 Storage device 40 Attack Simulation Device 50 Output Device 100 Systems 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. a first attack step detection means for executing an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detecting a first attack step that satisfies a damage condition for causing damage to the first virtual model; an input / output condition extraction means for extracting input conditions and output conditions of the first virtual model from the detected first attack step; a second attack step detection means for executing an attack simulation on a second virtual model acquired from the storage device, and detecting a second attack step in which an output of the second virtual model satisfies the input condition; a conversion means for converting the input condition and the output condition into descriptions corresponding to the types of the attack simulations when the types of the attack simulations of the first attack step and the second attack step are different; a combination means for combining the first attack step and the second attack step to generate an attack scenario, an input of the first virtual model is set as an output of the second virtual model, and an output of the first virtual model is set as an input of the second virtual model; Attack scenario generator.

2. The attack scenario generation device according to claim 1, A plurality of the first and second attack steps are generated in parallel. Attack scenario generator.

3. The computer Executing an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detecting a first attack step that satisfies a damage condition that causes damage to the first virtual model; Extracting input conditions and output conditions of the first virtual model from the detected first attack step; Executing an attack simulation on the second virtual model acquired from the storage device to detect a second attack step in which an output of the second virtual model satisfies the input condition; When the types of the attack simulations of the first attack step and the second attack step are different, converting the input condition and the output condition into descriptions according to the types of the attack simulations; generating an attack scenario by combining the first attack step and the second attack step; an input of the first virtual model is set as an output of the second virtual model, and an output of the first virtual model is set as an input of the second virtual model; Method for generating attack scenarios.

4. The attack scenario generation method according to claim 3, A plurality of the first and second attack steps are generated in parallel. Method for generating attack scenarios.

5. On the computer, Executing an attack simulation on a first virtual model acquired from a storage device in which a plurality of virtual models used to represent a target system are stored, and detecting a first attack step that satisfies a damage condition that causes damage to the first virtual model; extracting input conditions and output conditions of the first virtual model from the detected first attack step; executing an attack simulation on the second virtual model acquired from the storage device, and detecting a second attack step in which an output of the second virtual model satisfies the input condition; When the types of the attack simulations of the first attack step and the second attack step are different, the input condition and the output condition are converted into descriptions corresponding to the types of the attack simulations; generating an attack scenario by combining the first attack step and the second attack step; an input of the first virtual model is set as an output of the second virtual model, and an output of the first virtual model is set as an input of the second virtual model; program.

6. The program according to claim 5, A plurality of the first and second attack steps are generated in parallel. program.

Images