Information processing device and program

Abstract

To further accurately evaluate resistance against cyber attack even in a system having a multistage network segment.SOLUTION: An attack control device of an embodiment includes: a storage unit; a selection unit; a determination unit; and a calculation unit. The storage unit stores a normal communication data model indicating a model of a normal system communication data for each of network segments in association with each other. The selection unit specifies a network segment on the basis of communication prediction data predicted at execution of an attack scenario, and selects a normal communication data model associated with the network segment. The determination unit determines similarity between normal communication data indicated by the normal communication data model and the communication prediction data. The calculation unit calculates effectiveness of the attack scenario higher with higher similarity.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] An embodiment of the present invention relates to an information processing device and a program. [Background technology]

[0002] In order to protect information systems from cyber attacks, there are known techniques for grasping what kind of cyber attack methods are effective against the system. For example, there is a technique for comparing an attack sample with a single normal state model and extracting an attack sample that is at high risk of being attacked against the system. There is also a technique for calculating the importance score of an attack based on, for example, the number of attack paths, the attack cost, the repair cost, the success probability, etc. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6548837 [Patent Document 2] U.S. Pat. No. 1,063,7883 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with conventional technology, it has been difficult to more accurately evaluate the resistance of a system to cyber attacks in a system having multiple network segments. [Means for solving the problem]

[0005] The attack control device of the embodiment includes a storage unit, a selection unit, a determination unit, and a calculation unit. The storage unit stores a normal communication data model indicating a model of normal communication data in association with each network segment. The selection unit identifies a network segment based on communication prediction data predicted when an attack scenario is executed, and selects a normal communication data model associated with the network segment. The determination unit determines a similarity between normal communication data indicated by the normal communication data model and the communication prediction data. The calculation unit calculates the effectiveness of the attack scenario to be higher as the similarity is higher. [Brief description of the drawings]

[0006] [Figure 1] FIG. 2 is a diagram showing an example of the functional configuration of the information processing apparatus according to the first embodiment. [Diagram 2] FIG. 4 is a diagram showing an example of data in an attack scenario storage unit in the first embodiment. [Diagram 3] FIG. 2 is a diagram showing an example of an attack evaluation target system according to the first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of data in an attack communication data storage unit in the first embodiment. [Diagram 5] FIG. 4 is a diagram showing an example of data in a communication prediction data storage unit according to the first embodiment; [Figure 6] FIG. 4 is a diagram showing an example of data in a normal communication data model storage unit according to the first embodiment; [Figure 7] FIG. 4 is a diagram showing an example of data in a determination result storage unit according to the first embodiment. [Figure 8] FIG. 4 is a diagram showing an example of data in an effectiveness storage unit according to the first embodiment; [Figure 9] 4 is a flowchart showing an example of an information processing method according to the first embodiment. [Figure 10] FIG. 13 is a diagram showing an example of the functional configuration of an information processing apparatus according to a second embodiment. [Figure 11] FIG. 11 is a diagram showing an example of data in a communication prediction data storage unit according to the second embodiment. [Figure 12] FIG. 13 is a diagram showing an example of data in an attack scenario model storage unit according to the second embodiment. [Figure 13] 10 is a flowchart showing an example of an information processing method according to a second embodiment. [Figure 14] FIG. 13 is a diagram showing an example of the functional configuration of an information processing apparatus according to a third embodiment. [Figure 15] FIG. 13 is a diagram showing an example of data in an exclusion setting storage unit according to the third embodiment. [Figure 16] 13 is a flowchart showing an example of an information processing method according to a third embodiment. [Figure 17] A diagram showing an example of the hardware configuration of an attack control device of the first to third embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] Hereinafter, an embodiment of an information processing device and a program will be described in detail with reference to the accompanying drawings.

[0008] (First embodiment) First, an example of the functional configuration of the information processing apparatus according to the first embodiment will be described.

[0009] [Example of functional configuration] Fig. 1 is a diagram showing an example of a functional configuration of an information processing device 100 according to the first embodiment. The information processing device 100 according to the first embodiment includes a prediction unit 1, an effectiveness calculation unit 2, an attack scenario storage unit 101 (Fig. 2), an attack communication data storage unit 102 (Fig. 4), a communication prediction data storage unit 103 (Fig. 5), a normal communication data model storage unit 104 (Fig. 6), and an effectiveness storage unit 106 (Fig. 8). The effectiveness calculation unit 2 includes a selection unit 21, a judgment unit 22, a calculation unit 23, and a judgment result storage unit 105 (Fig. 7).

[0010] The prediction unit 1 predicts communication prediction data based on the attack scenario in the attack scenario storage unit 101 and the attack communication data in the attack communication data storage unit 102.

[0011] [Example of data from the attack scenario memory] FIG. 2 is a diagram showing an example of data in the attack scenario storage unit 101 in the first embodiment. The data in the attack scenario storage unit 101 in the first embodiment includes at least an attack scenario number, an attack source identifier, an attack destination identifier, and an attack module identifier. The attack scenario number is a number that identifies an attack scenario. The attack source identifier is information that identifies the attack source. The attack destination identifier is information that identifies the attack destination. The attack module identifier is information that identifies the attack destination module (e.g., an attack module name, etc.).

[0012] In the example of FIG. 2, a system to be evaluated for attacks from the information processing device 100 has the configuration shown in FIG.

[0013] [Examples of systems subject to attack evaluation] 3 is a diagram showing an example of the device configuration of the attack evaluation target system 200 of the first embodiment. The attack evaluation target system 200 of the first embodiment includes device A, device B, device C, and device D. Device A, device B, and device C are directly connected to each other via network segment X, and have identifiers of 192.168.0.2, 192.168.0.5, and 192.168.0.8, respectively. Device B, device C, and device D are directly connected to each other via network segment Y, and have identifiers of 192.168.1.5, 192.168.1.8, and 192.168.1.10, respectively.

[0014] The example of FIG. 2 shows an attack scenario in which an attacker intrudes from device A to device D in the system 200 under attack evaluation.

[0015] For example, attack scenario number S01 indicates a method that combines the attack means of "attack source identifier 192.168.0.2, attack destination identifier 192.168.0.5, attack module identifier ms10_061_spoolss" and the attack means of "attack source identifier 192.168.1.5, attack destination identifier 192.168.1.10, attack module modbusclient."

[0016] For example, attack scenario number S02 indicates a method that combines the attack means of "attack source identifier 192.168.0.2, attack destination identifier 192.168.0.8, attack module cve_2019_0708_bluekeep_rce" and the attack means of "attack source identifier 192.168.1.8, attack destination identifier 192.168.1.10, attack module identifier modbusclient."

[0017] [Example of data from the attack communication data storage unit] 4 is a diagram showing an example of data in the attack communication data storage unit 102 of the first embodiment. The data in the attack communication data storage unit 102 of the first embodiment includes at least an attack module identifier, an attack source identifier, an attack destination identifier, and attack communication data. The explanation of the attack module identifier, the attack source identifier, and the attack destination identifier is omitted because they are the same as those in FIG. 2.

[0018] The attack communication data includes at least the time, source identifier, destination identifier, and payload of each communication. This attack communication data is communication data generated when an attack is carried out based on the attack module identifier, attack source identifier, and attack destination identifier. The time indicates the time when each communication begins, but the time value may be arbitrary. The source identifier is information that identifies the source of each communication. The destination identifier is information that identifies the destination of each communication. The payload is the main body of data transmitted in each communication. The payload value may be arbitrary.

[0019] Figure 4 shows attack communication data corresponding to various attack methods. For example, the attack communication data of the attack method "attack module identifier ms10_061_spoolss, attack source identifier: 10.0.0.1, and attack destination identifier: 10.0.0.2" is composed of one or more attack packets such as "time: 00:00, source identifier: 10.0.0.1, destination identifier: 10.0.0.2, and payload: "#%)('&!%~&"$%*" and "time: 00:01, source identifier: 10.0.0.2, destination identifier: 10.0.0.1, and payload: $('&&*+``=)('&$(=(('".

[0020] [Example of data in communication prediction data storage unit] 5 is a diagram showing an example of data in the communication prediction data storage unit 103 in the first embodiment. The data in the communication prediction data storage unit 103 in the first embodiment includes at least an attack means number, an attack source identifier, an attack destination identifier, an attack module identifier, and communication prediction data.

[0021] The attack means number is a number that identifies the attack means (a combination of an attack source identifier, an attack destination identifier, and an attack module identifier). The explanation of the attack source identifier, the attack destination identifier, and the attack module identifier is omitted because they are the same as those in FIG. 2.

[0022] The communication prediction data includes at least the time, source identifier, destination identifier, and payload of each communication predicted by the prediction unit 1. The explanation of the time, source identifier, destination identifier, and payload is omitted since it is the same as in FIG.

[0023] The prediction unit 1 predicts communication prediction data from attack communication data (see FIG. 4) indicating communication data when an attack module identified by an attack module identifier is executed, an attack source identifier, and an attack destination identifier.

[0024] 5 shows communication prediction data corresponding to various attack means. For example, the communication prediction data for the attack means with attack means number: A01 (attack source identifier: 192.168.0.2, attack destination identifier: 192.168.0.5, attack module identifier: ms10_061_spoolss) is composed of one or more predicted packets such as "Time: 00:00, source identifier: 192.168.0.2, destination identifier: 192.168.0.5, and payload: "#%)('&!%~&"$%*" and "Time: 00:01, source identifier: 192.168.0.5, destination identifier: 192.168.0.2, and payload: $('&&*+``=)('&$(=(('".

[0025] Returning to FIG. 1, the selection unit 21 identifies a network segment based on communication prediction data predicted when an attack scenario is executed, and selects a normal communication data model associated with the network segment.

[0026] [Example of data in normal communication data model storage section] 6 is a diagram showing an example of data in the normal communication data model storage unit 104 in the first embodiment. The data in the normal communication data model storage unit 104 in the first embodiment includes at least a network segment and a normal communication data model. The network segment indicates a divided network. The normal communication data model indicates a model of normal communication data in a network segment.

[0027] The example in FIG. 6 indicates that the normal communication data model for the network segment "192.168.0.0 / 24" is "Abaflteobf-e09kba".

[0028] Returning to FIG. 1, the determination unit 22 determines the similarity between the normal communication data indicated by the normal communication data model selected by the selection unit 21 and the communication prediction data predicted by the prediction unit 1.

[0029] [Example of data in the judgment result storage unit] 7 is a diagram showing an example of data in the judgment result storage unit 105 in the first embodiment. The data in the judgment result storage unit 105 in the first embodiment includes at least an attack means number, a source identifier, a destination identifier, an attack module identifier, and a similarity judgment result. The explanation of the attack means number, the source identifier, the destination identifier, and the attack module identifier is omitted because it is the same as in FIG. 5.

[0030] The similarity determination result indicates the result of the similarity determined by the determination unit 22 (for example, 1: similar, 0: not similar). Note that the similarity is not limited to a discrete value such as 0 or 1, and may be expressed as a continuous value indicating the magnitude of the similarity depending on the magnitude of the value.

[0031] In the example of FIG. 7, for example, the similarity judgment result for the attack means with attack means number: A01 (attack source identifier: 192.168.0.2, attack destination identifier: 192.168.0.5, and attack module identifier: ms10_061_spoolss) is shown to be 1 (similar).

[0032] For example, the similarity judgment result for the attack means number: A03 (attack source identifier: 192.168.0.2, attack destination identifier: 192.168.0.8, attack module identifier: cve_2019_0708_bluekeep_rce) is 0 (not similar).

[0033] Returning to FIG. 1, the calculation unit 23 calculates the effectiveness of the attack scenario to be higher as the similarity determined by the determination unit 22 is higher.

[0034] [Example of data from the effectiveness memory section] Fig. 8 is a diagram showing an example of data in the effectiveness storage unit 106 in the first embodiment. The data in the effectiveness storage unit 106 in the first embodiment includes at least an attack scenario number and effectiveness. The explanation of the attack scenario number is omitted since it is the same as in Fig. 2. The effectiveness indicates the effectiveness of the attack scenario identified by the attack scenario number. An example of a method for calculating the effectiveness will be described later.

[0035] In the example of FIG. 8, for example, the effectiveness of an attack scenario identified by attack scenario number S01 is 1, while the effectiveness of an attack scenario identified by attack scenario number S02 is 0.1.

[0036] [Examples of information processing methods] 9 is a flowchart showing an example of the information processing method according to the first embodiment. First, the prediction unit 1 acquires an attack scenario (attack scenario number, attack source identifier, attack destination identifier, and attack module identifier) ​​from the attack scenario storage unit 101 (step S1).

[0037] Next, the prediction unit 1 obtains at least one piece of attack communication information identified by the attack module identifier of the attack scenario, namely, an attack source identifier, an attack destination identifier, and attack communication data (source identifier, destination identifier, and payload), from the attack communication data storage unit 102 (step S2).

[0038] Next, the prediction unit 1 predicts the communication prediction data based on the attack source identifier and attack destination identifier of the attack communication information and the attack source identifier and attack destination identifier of the attack scenario (step S3). Specifically, the prediction unit 1 predicts the source identifier and destination identifier of the communication prediction data by changing (modifying) the source identifier and destination identifier of the attack communication data according to the environment (e.g., the attack source identifier and the attack destination identifier, etc.) of the attack evaluation target system 200. In addition, the prediction unit 1 changes the payload of the communication prediction data according to the predicted source identifier and destination identifier, if necessary. Then, the prediction unit 1 assigns an attack means number, which is an arbitrary unique identifier, to the data that combines the attack source identifier, attack destination identifier, and attack module identifier of the attack scenario with the communication prediction data, and stores it in the communication prediction data storage unit 103.

[0039] Next, the selection unit 21 acquires the communication prediction information (attack means number, attack source identifier, attack destination identifier, attack module identifier, and communication prediction data) from the communication prediction data storage unit 103 (step S4).

[0040] Next, the selection unit 21 acquires a normal communication data model corresponding to the network segment including the attack source identifier and the attack destination identifier from the normal communication data model storage unit 104 (step S5). That is, the selection unit 21 identifies a network segment from the attack source identifier and the attack destination identifier, and selects a normal communication data model associated with the network segment.

[0041] Next, the determination unit 22 determines the similarity between the communication prediction data acquired in step S4 and the normal communication data indicated by the normal communication data model selected in step S5 (step S6). For example, the determination unit 22 trains a recent attack detection system (IDS: Intrusion Detection System) with the normal communication data model and applies the communication prediction data to the learning result. Specifically, the determination unit 22 may determine that the communication is similar (value: 1) when the attack is not detected by the attack detection system (cannot be distinguished from normal communication), and determine that the communication is not similar (value: 0) when the attack is detected (can be distinguished from normal communication). Then, the determination unit 22 stores the determination result of the similarity in the determination result storage unit 105 in association with the attack means number, the attack source identifier, the attack destination identifier, and the attack module identifier (step S7).

[0042] Next, the calculation unit 23 acquires the attack scenario (attack scenario number, attack source identifier, attack destination identifier, and attack module identifier) ​​from the attack scenario storage unit 101 (step S8).

[0043] Next, the calculation unit 23 calculates the effectiveness of the attack scenario acquired in step S8 (step S9). Specifically, first, the calculation unit 23 acquires from the judgment result storage unit 105 each of the similarity judgment results associated with the attack means identified by the attack source identifier, attack destination identifier, and attack module identifier of the attack scenario. For example, the calculation unit 23 calculates the effectiveness of the attack scenario by multiplying the effectiveness of 1 for similar attack means and 0.1 for dissimilar attack methods. Then, the calculation unit 23 stores the effectiveness calculated in step S9 in the effectiveness storage unit 106 in association with the attack scenario number (step S10).

[0044] [Specific example] A specific example will be described below in which the effectiveness of attack scenarios illustrated in Fig. 3 is evaluated for the attack evaluation target system 200 in Fig. 2. First, the prediction unit 1 acquires attack scenarios identified by attack scenario numbers S01, S02, ....

[0045] Next, the prediction unit 1 acquires attack communication data, which is communication data corresponding to the attack module identifiers (ms10_061_spoolss, modbusclient, cve_2019_0708_bluekeep_rce) included in each attack scenario.

[0046] Next, the prediction unit 1 changes (modifies) the source identifier and destination identifier in the attack communication data to match the attack scenario. For example, for the attack module identifier ms10_061_spoolss of the attack scenario number S01, the prediction unit 1 changes the source identifier "10.0.0.1" in the attack communication data to "192.168.0.2" and the destination identifier "10.0.0.2" in the attack communication data to "192.168.0.5" based on the source identifier and destination identifier of the attack scenario and the source identifier and destination identifier of the attack communication information.

[0047] Finally, the prediction unit 1 stores the attack source identifier 192.168.0.2, the attack destination identifier 192.168.0.5, and the attack module identifier ms10_061_spoolss as the attack means number A01, and the communication prediction data in the communication prediction data storage unit 103 as shown in FIG.

[0048] Next, the selection unit 21 acquires data corresponding to the attack means number A01 from the communication prediction data storage unit 103 (the attack source identifier 192.168.0.2, the attack destination identifier 192.168.0.5, the attack module identifier ms10_061_spoolss, and the communication prediction data of this attack means).

[0049] In addition, the selection unit 21 acquires, from the normal communication data model storage unit 104, the normal communication data model "Abaflteobf-e09kba" corresponding to the network segment 192.168.0.0 / 24 that includes the attack source identifier 192.168.0.2 and the attack destination identifier 192.168.0.5.

[0050] Next, the determination unit 22 determines the similarity between the normal communication data indicated by the normal communication data model "Abaflteobf-e09kba" and the communication prediction data.

[0051] 7, the similarity judgment result of the attack means identified by the attack means number A01 is 1 (similar). The judgment unit 22 associates the attack means number A01, the attack source identifier 192.168.0.2, the attack destination identifier 192.168.0.5, and the attack module identifier ms10_061_spoolss with the similarity judgment result 1, and stores them in the judgment result storage unit 105.

[0052] On the other hand, the similarity judgment result of the attack means identified by the attack means number A03 is 0 (not similar). The judgment unit 22 associates the attack means number A03, the attack source identifier 192.168.0.2, the attack destination identifier 192.168.0.8, and the attack module identifier cve_2019_0708_bluekeep_rce with the similarity judgment result 0 and stores them in the judgment result storage unit 105.

[0053] The calculation unit 23 obtains attack scenario numbers S01, S02 . . . from the attack scenario storage unit 101.

[0054] The calculation unit 23 also obtains a similarity judgment result 1 of the attack means "attack source identifier 192.168.0.2, attack destination identifier 192.168.0.5, and attack module identifier ms10_061_spoolss" included in the attack scenario with attack scenario number S01 from the judgment result storage unit 105. The calculation unit 23 also obtains a similarity judgment result 1 of the attack means "attack source identifier 192.168.1.5, attack destination identifier 192.168.1.10, and attack module identifier modbusclient" included in the attack scenario with attack scenario number S01 from the attack scenario storage unit 101. Then, the calculation unit 23 calculates the effectiveness of the attack scenario with attack scenario number S01 by 1*1=1.

[0055] On the other hand, the calculation unit 23 obtains a similarity judgment result of 0 for the attack means "attack source identifier 192.168.0.2, attack destination identifier 192.168.0.8, and attack module identifier cve_2019_0708_bluekeep_rce" included in the attack scenario of attack scenario number S02 from the judgment result storage unit 105. Also, the calculation unit 23 obtains a similarity judgment result of 1 for the attack means "attack source identifier 192.168.1.8, attack destination identifier 192.168.1.10, and attack module identifier modbusclient" included in the attack scenario of attack scenario number S02 from the judgment result storage unit 105. Then, the calculation unit 23 calculates the effectiveness of the attack scenario of attack scenario number S02 by 0.1*1=0.1.

[0056] Finally, the calculation unit 23 stores (attack scenario number S01, effectiveness 1) and (attack scenario number S02, attack scenario effectiveness 0.1) in the effectiveness storage unit 106.

[0057] As described above, in the information processing device 100 of the first embodiment, the normal communication data model storage unit 104 stores normal communication data models indicating models of normal communication data in association with each network segment. The selection unit 21 identifies a network segment based on communication prediction data predicted when an attack scenario is executed, and selects a normal communication data model associated with the network segment. The determination unit 22 determines the similarity between the normal communication data indicated by the normal communication data model and the communication prediction data. Then, the calculation unit 23 calculates the effectiveness of the attack scenario to be higher as the similarity increases.

[0058] As a result, the information processing apparatus 100 of the first embodiment can more accurately evaluate resistance to cyber attacks even in a system having multiple network segments.

[0059] Specifically, according to the information processing device 100 of the first embodiment, it is possible to extract an attack scenario that can be embedded into normal communication based on the similarity between the communication prediction data of each attack method and normal communication data in a network segment.

[0060] In a system having multiple network segments, such as a control system, normal communication used in each network segment is often different. In the conventional method using a single normal state model and a method using a simple attack path, it is difficult to reflect the characteristics of the single normal state model and the characteristics of the simple attack path in a system having multiple network segments.

[0061] On the other hand, in the information processing device 100 of the first embodiment, for example, in the case of the data example of the effectiveness storage unit 106 in Fig. 8, the effectiveness of the attack scenario with attack scenario number S01, which has a high similarity to normal communication data, is high. On the other hand, the effectiveness of the attack scenario with attack scenario number S02, which has a low similarity to normal communication data, is low. In other words, the attack scenario with attack scenario number S02, some of whose attack means are detected by an IDS or the like, has a low effectiveness. In other words, it can be seen that measures need to be taken in the attack evaluation target system 200 to improve resistance to the attack scenario with attack scenario number S01.

[0062] In addition, in the first embodiment, since a normal communication data model is used for each network segment, it is possible to determine the similarity according to the communication data flowing through the network segment. In other words, the effectiveness of the attack scenario becomes a value more suitable for the attack evaluation target system 200.

[0063] Incidentally, in this embodiment, IP addresses are used as the attack source identifier and the attack destination identifier, but MAC addresses, node IDs, station IDs, etc. may also be used as the attack source identifier and the attack destination identifier.

[0064] In addition, in this embodiment, when the prediction unit 1 predicts the communication prediction data, only the source identifier and the destination identifier are changed, but data other than the source identifier and the destination identifier may be changed. For example, if the payload of the attack communication data includes the source identifier, the destination identifier, and data dependent on the source identifier and the destination identifier, the payload may also be changed to an appropriate value. In addition, when the prediction unit 1 predicts the communication prediction data, the time included in the communication prediction data may be appropriately corrected in accordance with the flow of the communication data.

[0065] Furthermore, in this embodiment, the selection unit 21 acquires a normal communication data model corresponding to a network segment including an attack source identifier and an attack destination identifier, but may acquire a normal communication data model corresponding to a network segment including a source identifier and a destination identifier included in the communication prediction data. That is, the selection unit 21 may identify a network segment from the source identifier and the destination identifier, and select a normal communication data model associated with the network segment.

[0066] Although the normal communication data model storage unit 104 of this embodiment has a normal communication data model for each network segment, the method of storing the normal communication data model is not limited to this method. For example, the normal communication data model may be stored by pairing one or more identifiers with the normal communication data model. The one or more identifiers are values ​​used in the attack source identifier and the attack source identifier, etc. (e.g., IP address and MAC address, etc.). In this case, the selection unit 21 acquires the normal communication data model corresponding to the attack source identifier and the attack destination identifier.

[0067] In addition, in the calculation unit 23 of this embodiment, when the similarity is 1, it is multiplied by 1, and when the similarity is 0, it is multiplied by 0.1, but the calculation method is not limited to this. For example, when the similarity is 1, it is multiplied by 0.5, and when the similarity is 0, it is multiplied by 0.1. Also, for example, a method may be used in which 100 is given as the initial value of the validity, and when the similarity is 1, it is left as it is, and when the similarity is 0, 1 is subtracted.

[0068] Second embodiment Next, a second embodiment will be described. In the description of the second embodiment, the same description as in the first embodiment will be omitted, and only the differences from the first embodiment will be described. In the first embodiment, the effectiveness of an attack scenario is calculated after dividing the attack scenario into one or more attack means, but in this embodiment, a case will be described in which the effectiveness of an attack scenario is calculated without dividing the attack scenario into attack means.

[0069] [Example of functional configuration] 10 is a diagram illustrating an example of a functional configuration of an information processing device 100-2 according to the second embodiment. The information processing device 100-2 according to the second embodiment includes a prediction unit 1, an effectiveness calculation unit 2-2, an attack scenario storage unit 101, an attack communication data storage unit 102, a communication prediction data storage unit 103-2 (FIG. 11), a normal communication data model storage unit 104, and an effectiveness storage unit 106.

[0070] The attack scenario storage unit 101, the attack communication data storage unit 102, the normal communication data model storage unit 104, and the validity storage unit 106 in the second embodiment will be omitted since they are similar to those in the first embodiment.

[0071] In the second embodiment, the prediction unit 1 stores communication prediction data (time, source identifier, destination identifier, and payload) for each attack scenario number in the communication prediction data storage unit 103-2.

[0072] [Example of data in communication prediction data storage unit] 11 is a diagram showing an example of data in the communication prediction data storage unit 103-2 in the second embodiment. The data in the communication prediction data storage unit 103-2 in the second embodiment includes at least an attack scenario number and communication prediction data. The explanation of the attack scenario number is omitted because it is the same as that in FIG. 2.

[0073] The communication prediction data includes at least the time, source identifier, destination identifier, and payload of each communication predicted by the prediction unit 1. The explanation of the time, source identifier, destination identifier, and payload is omitted since it is the same as in FIG.

[0074] 11 shows communication prediction data corresponding to various attack scenarios. For example, an attack scenario with attack scenario number S01 includes communication prediction data C001, C002, C100, C101, C102, and C150.

[0075] Returning to FIG. 10, the effectiveness calculation unit 2-2 includes a calculation unit 23, a division unit 24, and an attack scenario / model storage unit 107 (FIG. 12).

[0076] The division unit 24 divides a plurality of pieces of communication prediction data associated with an attack scenario number into two or more pieces, and associates a different normal communication data model with each of the divided pieces of communication prediction data.

[0077] [Example of data in the attack scenario model storage section] Fig. 12 is a diagram showing an example of data in the attack scenario model storage unit 107 in the second embodiment. The data in the attack scenario model storage unit 107 in the second embodiment includes at least communication prediction data and a normal communication data model. The communication prediction data corresponds to the communication prediction data in Fig. 11. The explanation of the normal communication data model is omitted since it is the same as that in Fig. 6.

[0078] The attack scenario / model storage unit 107 of the second embodiment stores one or more pieces of communication prediction data generated in an attack scenario and a normal communication data model corresponding to the communication prediction data. In the example of Fig. 12, for example, the communication prediction data C001 to C100 and the normal communication data model "Abaflteobf-e09kba" are stored in association with each other.

[0079] [Examples of information processing methods] 13 is a flowchart showing an example of an information processing method according to the second embodiment. Explanation of steps S21 and S22 is omitted because they are similar to steps S1 and S2 (see FIG. 9) in the first embodiment.

[0080] The prediction unit 1 predicts the communication prediction data based on the source identifier and destination identifier of the attack communication data in the attack communication data storage unit 102 and the attack source identifier and attack destination identifier of the attack scenario (step S23). In the second embodiment, the prediction unit 1 stores the communication prediction data (time, source identifier, destination identifier, and payload) for each attack scenario number in the communication prediction data storage unit 103-2.

[0081] Next, the effectiveness calculation unit 2-2 (the calculation unit 23 and the division unit 24) executes the following for each attack scenario: First, the calculation unit 23 sets the effectiveness of the attack scenario to 1 (step S24).

[0082] Next, the division unit 24 acquires communication prediction data (time, source identifier, destination identifier, and payload) associated with the attack scenario number of the attack scenario to be processed from the communication prediction data storage unit 103-2 (step S25).

[0083] Next, the dividing unit 24 acquires a normal communication data model from the normal communication data model storage unit 104 based on the source identifier and the destination identifier acquired in step S25. Then, the dividing unit 24 stores an attack scenario model in which the communication prediction data and the normal communication data model are associated with each other in the attack scenario model storage unit 107 (step S26).

[0084] For example, in the case of the communication prediction data illustrated in Fig. 11, the division unit 24 combines the communication prediction data C001 to C100 into one and associates "Abaflteobf-e09kba" as a normal communication data model. The division unit 24 also combines the communication prediction data C101 to C150 into one and associates "04ktb;glagAfgar03" as a normal communication data model. That is, in the example of Fig. 11, a plurality of communication prediction data associated with the attack scenario number S01 are divided into two, and a different normal communication data model is associated with each of them.

[0085] Next, the calculation unit 23 acquires the normal communication data model and the communication prediction data from the attack scenario model storage unit 107, and determines the similarity between the normal communication data indicated by the normal communication data model and the communication prediction data (step S27). Next, the calculation unit 23 calculates the effectiveness of the attack scenario, and stores the effectiveness in the effectiveness storage unit 106 (step S28). Specifically, for example, when the calculation unit 23 determines that the similarity is 0 by the processing of step S27, it multiplies the effectiveness of the attack scenario by 0.1. Note that the initial value of the effectiveness may be any value, and for example, the initial value of the effectiveness is 1. After the calculation of the similarity and the calculation of the effectiveness based on the similarity for all communication prediction data associated with the attack scenario to be processed are completed, the calculation unit 23 stores the calculated effectiveness in the effectiveness storage unit 106 as a pair with the attack scenario number.

[0086] While there are unprocessed attack scenarios, the effectiveness calculation unit 2-2 (the calculation unit 23 and the division unit 24) returns to step S24 and repeats the processes of steps S24 to S28.

[0087] As described above, in the second embodiment, it is possible to extract attack scenarios that can be mixed into normal communications without dividing the attack scenarios into attack means. Also, in this embodiment, it is possible to determine the similarity according to the communication data flowing in the network segment by appropriately selecting a normal communication data model according to the communication prediction data. In other words, it is possible to set the effectiveness of the attack scenario to a value more suitable for the system to be evaluated for attack.

[0088] Third embodiment Next, a third embodiment will be described. In the description of the third embodiment, the same description as in the first embodiment will be omitted, and only the differences from the first embodiment will be described. In the first embodiment, the similarity was determined using all fields of the communication prediction data, but if there is a field with poor prediction accuracy, it is possible that this may affect the similarity determination. In the third embodiment, a case will be described in which the accuracy of the similarity determination is improved by excluding fields with poor prediction accuracy from among the fields in the communication prediction data.

[0089] [Example of device configuration] Fig. 14 is a diagram showing an example of a functional configuration of an information processing device 100-3 according to the third embodiment. The information processing device 100-3 according to the third embodiment includes a prediction unit 1, an effectiveness calculation unit 2, an attack scenario storage unit 101 (Fig. 2), an attack communication data storage unit 102 (Fig. 4), a communication prediction data storage unit 103 (Fig. 5), a normal communication data model storage unit 104 (Fig. 6), an effectiveness storage unit 106 (Fig. 8), and an exception setting storage unit 108 (Fig. 15). The effectiveness calculation unit 2 includes a selection unit 21, a determination unit 22, a calculation unit 23, and a determination result storage unit 105 (Fig. 7).

[0090] In the third embodiment, the judgment unit 22 identifies excluded field names from the communication prediction data that will not be used for similarity judgment based on the data stored in the exclusion setting memory unit 108, and judges the similarity with normal communication without using the excluded field names.

[0091] [Example of data in the exclusion settings memory section] FIG. 15 is a diagram showing an example of data in the exclusion setting storage unit of the third embodiment. The data in the exclusion setting storage unit 108 of the third embodiment includes at least the names of fields to be excluded. The names of fields to be excluded indicate the names of fields of the communication prediction data that are not used for similarity determination. In the example of FIG. 15, a time field is set as the names of fields to be excluded. This is because, in the example of the third embodiment, the time at which communication is performed can be arbitrary, and therefore, if the difference in time is taken into consideration in determining the similarity with normal communication, it is considered that there is a high possibility that the accuracy of the similarity determination will be deteriorated.

[0092] [Examples of information processing methods] Fig. 16 is a flowchart showing an example of an information processing method according to the third embodiment. Fig. 16 differs from the flowchart of the first embodiment (see Fig. 9) in that step S5-2 is added.

[0093] In step S5-2, the determination section 22 acquires the name of a field to be excluded from the exclusion setting storage section 108, and removes the field to be excluded specified by the name of the field to be excluded from the communication prediction data acquired in step S4.

[0094] Then, the determination unit 22 uses the communication prediction data changed by the process of step S5-2 and the normal communication data model to determine the similarity with the normal communication data (step S6). Thereafter, similarly to the first embodiment, the effectiveness of each attack scenario is calculated based on the determination result of the similarity.

[0095] In the example of Fig. 16, a method of excluding the excluded fields from the communication prediction data before applying the normal communication data model is described, but the exclusion method is not limited to this method. For example, if the similarity determination result obtained using the normal communication data model and the communication prediction data is caused by the excluded fields, a method of correcting the similarity determination result is also conceivable.

[0096] Specifically, for example, the determination unit 22 determines a first similarity indicating a similarity between the normal communication data indicated by the normal communication data model and the communication prediction data. The determination unit 22 also determines a second similarity indicating a similarity between the normal communication data indicated by the normal communication data model and the communication prediction data from which the excluded field is excluded. Then, the calculation unit 23 calculates the effectiveness of the attack scenario to be higher as the first similarity is higher, and corrects the effectiveness according to the difference between the first similarity and the second similarity. For example, the calculation unit 23 corrects the effectiveness to be higher as the second similarity is higher than the first similarity.

[0097] It is noted that the calculation unit 23 may correct the validity when the difference between the first similarity and the second similarity is greater than a threshold value, and may not need to correct the validity when the difference is equal to or smaller than the threshold value.

[0098] For example, when using an attack detection system (IDS) to determine the similarity judgment results, it is possible to set fields to be excluded in the attack detection system and then use a normal communication data model and communication prediction data to determine whether an attack has been detected or not.

[0099] As described above, in the third embodiment, by performing similarity judgment according to the prediction accuracy of the communication prediction data, the effectiveness of the attack scenario can be calculated using data with higher prediction accuracy. That is, the effectiveness of the attack scenario can be set to a value more suitable for the attack evaluation target system.

[0100] Finally, an example of the hardware configuration of the information processing apparatuses 100 (100-2, 100-3) according to the first to third embodiments will be described.

[0101] [Example of hardware configuration] 17 is a diagram showing an example of a hardware configuration of the information processing device 100 (100-2, 100-3) according to the first to third embodiments. The information processing device 100 (100-2, 100-3) according to the first to third embodiments includes a processor 201, a main storage device 202, an auxiliary storage device 203, a display device 204, an input device 205, and a communication device 206. The processor 201, the main storage device 202, the auxiliary storage device 203, the display device 204, the input device 205, and the communication device 206 are connected via a bus 210.

[0102] The information processing device 100 (100-2, 100-3) may not include some of the above configurations. For example, if the information processing device 100 (100-2, 100-3) can use the input function and display function of an external device, the information processing device 100 (100-2, 100-3) may not include the display device 204 and the input device 205.

[0103] The processor 201 executes a program read from the auxiliary storage device 203 to the main storage device 202. The main storage device 202 is a memory such as a ROM and a RAM. The auxiliary storage device 203 is a hard disk drive (HDD), a memory card, or the like.

[0104] The display device 204 is, for example, a liquid crystal display. The input device 205 is an interface for operating the information processing device 100. The display device 204 and the input device 205 may be realized by a touch panel having a display function and an input function. The communication device 206 is an interface for communicating with other devices.

[0105] The programs executed by the information processing devices 100 (100-2, 100-3) are provided as computer program products recorded in a computer-readable storage medium such as a CD-ROM, memory card, CD-R, or DVD in an installable or executable format file.

[0106] The programs executed by the information processing devices 100 (100-2, 100-3) may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. The programs executed by the information processing devices 100 (100-2, 100-3) may be provided via a network such as the Internet without being downloaded.

[0107] The programs for the information processing devices 100 (100-2, 100-3) may be provided in a state where they are pre-installed in a ROM or the like.

[0108] The programs executed by the information processing devices 100 (100-2, 100-3) have a modular configuration including functions that can be realized by the programs among the functional configurations in FIG. 1 (FIGS. 10 and 14) described above. As for each function, as actual hardware, the processor 201 reads out the program from a storage medium and executes it, and the above-mentioned functional blocks are loaded onto the main storage device 202. In other words, the above-mentioned functional blocks are generated on the main storage device 202.

[0109] Note that some or all of the functions shown in FIG. 1 (FIGS. 10 and 14) may be realized by hardware such as an IC rather than by software.

[0110] Furthermore, each function may be realized using a plurality of processors 201. In this case, each processor 201 may realize one of the functions, or may realize two or more of the functions.

[0111] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0112] 1. Prediction Department 2. Effectiveness calculation section 21 Selection Department 22 Judgment section 23 Calculation section 24 Division 100 Information processing device 101 Attack scenario memory section 102 Attack communication data storage unit 103 Communication prediction data storage unit 104 Normal communication data model storage unit 105 Judgment result storage unit 106 Effectiveness memory unit 107 Attack scenario model storage 108 Exclusion setting memory section 200 Attack Evaluation Target Systems 201 Processor 202 Main storage 203 Auxiliary storage device 204 Display device 205 Input Device 206 Communication Equipment 210 Bus

Claims

1. a storage unit that stores a normal communication data model that indicates a learning model of normal communication data in association with each network segment; an attack scenario including a first attack source identifier that identifies a first attack source, a first attack destination identifier that identifies a first attack destination, and an attack module identifier that identifies an attack module, and a prediction unit that predicts communication prediction data that is predicted when the attack scenario is executed from attack communication data that indicates communication data when the attack module identified by the attack module identifier is executed; A selection unit that identifies a network segment based on the communication prediction data and selects a normal communication data model associated with the network segment; a determination unit that determines a similarity between the normal communication data indicated by the normal communication data model and the communication prediction data; a calculation unit that calculates a higher effectiveness of the attack scenario as the similarity is higher; An information processing device comprising:

2. the communication prediction data is associated with the first attack source identifier and the first attack destination identifier, the selection unit identifies the network segment from the first attack source identifier and the first attack destination identifier, and selects a normal communication data model associated with the network segment. The information processing device according to claim 1 .

3. the communication prediction data includes at least one prediction data of a communication identified by a first source identifier that identifies a first source and a first destination identifier that identifies a first destination, The selection unit identifies the network segment from the first transmission source identifier and the first transmission destination identifier, and selects a normal communication data model associated with the network segment. The information processing device according to claim 1 .

4. the attack communication data includes at least one attack packet identified by a second source identifier that identifies a second source and a second destination identifier that identifies a second destination; the prediction unit predicts the communication prediction data by changing a second source identifier to the first source identifier and changing a second destination identifier to the first destination identifier based on the first attack source identifier and the first attack destination identifier; The information processing device according to claim 3 .

5. The communication prediction data includes a plurality of fields, The method further includes an exclusion setting storage unit that stores an exclusion target field to be excluded from among the plurality of fields, The determination unit determines a similarity between the normal communication data indicated by the normal communication data model and communication prediction data from which the exclusion target field has been excluded. The information processing device according to claim 1 .

6. The communication prediction data includes a plurality of fields, The method further includes an exclusion setting storage unit that stores an exclusion target field to be excluded from among the plurality of fields, the determination unit determines a first similarity indicating a similarity between the normal communication data indicated by the normal communication data model and the communication prediction data, and a second similarity indicating a similarity between the normal communication data indicated by the normal communication data model and the communication prediction data from which the exclusion target field has been excluded; the calculation unit calculates a higher effectiveness of the attack scenario as the first similarity is higher, and corrects the effectiveness in accordance with a difference between the first similarity and the second similarity. The information processing device according to claim 1 .

7. the calculation unit corrects the effectiveness when a difference between the first similarity and the second similarity is greater than a threshold, and does not correct the effectiveness when the difference is equal to or less than the threshold. The information processing device according to claim 6.

8. The excluded field is a time field of the communication prediction data. The information processing device according to claim 5 .

9. A computer including a storage unit that stores a normal communication data model that indicates a learning model of normal communication data in association with each network segment, an attack scenario including a first attack source identifier that identifies a first attack source, a first attack destination identifier that identifies a first attack destination, and an attack module identifier that identifies an attack module, and a prediction unit that predicts communication prediction data that is predicted when the attack scenario is executed from attack communication data that indicates communication data when the attack module identified by the attack module identifier is executed; A selection unit that identifies a network segment based on the communication prediction data and selects a normal communication data model associated with the network segment; a determination unit that determines a similarity between the normal communication data indicated by the normal communication data model and the communication prediction data; a calculation unit that calculates the effectiveness of the attack scenario to be higher as the similarity is higher; A program to function as a

Images