Attack route extraction system, attack route extraction method, and program

Abstract

Provided is an attack route extraction system that contributes to extracting, from an attack graph, an attack route suitable for security risk diagnosis. This attack route extraction system comprises: a function unit that extracts attack steps that may be performed in a system to be diagnosed, according to configuration information of the system to be diagnosed; a cost setting unit that sets costs for the attack steps on the basis of at least one of threat information, attack content information, and countermeasure possibility information that is based on countermeasure information corresponding to an attack means; and an attack route extraction unit that determines a priority for each attack route obtained by connecting one or more attack steps from an entry point to an attack target in the system to be diagnosed on the basis of the costs for the attack steps set by the cost setting unit, and extracts the attack routes in the order of priority.

Description

[Technical field]

[0001] The present invention relates to an attack route extraction system, an attack route extraction method, and a program. [Background technology]

[0002] In risk analysis of a system to be diagnosed, an attack route is extracted based on various configuration information at the time of analysis, including information such as the attack means and conditions, as well as the hosts passed through, from the entry point to the target of attack. An attack graph is extracted by collecting configuration information of the system to be diagnosed, extracting system information, and performing risk analysis using an inference engine. The attack graph obtained from risk analysis includes attack conditions and attack means, and each stage that leads to a different state due to an attack means is called an attack step. The attack route is a connection of each attack step (edges that indicate attack means).

[0003] Patent Document 1 relates to a risk analysis result display device that can grasp changes in risk in a system.

[0004] Patent Document 2 relates to an information processing device that specifies a combination of candidate countermeasures to be applied for each combination of attack activities.

[0005] Patent Document 3 relates to an incident analysis device that can identify a suspected attack even if multiple suspected attacks are found. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] International Publication No. 2021 / 130943 [Patent Document 2] Republished Patent No. 2018 / 134909 [Patent Document 3] JP 2019-050477 A Summary of the Invention [Problem to be solved by the invention]

[0007] The following analysis is given by the present invention. For example, as shown in FIG. 5 as an example, the system to be diagnosed includes hosts A, B, C, D, E, and F, and hosts A and B, C and D, and E and F are connected by a network, and a firewall FW is provided between (A and B), (C and D), and (E and F), respectively, and access from A and B to C and D is permitted, and access from C and D to E and F is permitted. The attack graph is extracted by analyzing the configuration information of the system to be diagnosed. The attack source and destination nodes A, B, C, D, E, and F of the attack graph correspond to hosts A, B, C, D, E, and F in the system to be diagnosed. In this case, the attack route is extracted from the attack graph as all attack routes that connect the attack steps (edges) as shown below. In this example, the attack means are omitted. A, B, C, D, E, F A, B, C, D, F A, B, C, E, F A, B, C, F A, B, D, C, E, F A, B, D, C, F A, B, D, E, F A, B, D, F A, C, D, E, F A, C, D, F A, C, E, F A, C, F A, D, C, E, F A, D, C, F A, D, E, F A, D, F In this way, each attack route can be shown by enumerating the nodes in turn.

[0008] In order to perform security risk diagnosis, there is a demand for output in the form of attack routes rather than attack graphs. However, if all attack routes included in the attack graph obtained from the configuration information of the system to be diagnosed are enumerated, the number of attack routes becomes enormous, making it difficult to grasp all security risks from the enumerated attack routes.

[0009] An object of the present invention is to provide an attack route extraction system, an attack route extraction method, and a program that contribute to extracting attack routes suitable for performing security risk diagnosis from an attack graph. [Means for solving the problem]

[0010] According to a first aspect of the present invention, there is provided a functional unit for extracting attack steps that can be performed on a system to be diagnosed in accordance with configuration information of the system to be diagnosed; a cost setting unit that sets a cost for the attack step based on at least one of information on threat information, attack content information, and countermeasure possibility information based on countermeasure information corresponding to the attack means; It is possible to provide an attack route extraction system that includes an attack route extraction unit that determines the priority of each attack route obtained by connecting one or more attack steps from the entry point of the system to be diagnosed to the attack target based on the cost of the attack step set by the cost setting unit, and extracts the attack routes in order of highest priority.

[0011] According to a second aspect of the present invention, there is provided an attack route extraction method executed by a computer having a processor and a recording device, the method comprising: extracting attack steps that can be performed on the system to be diagnosed according to configuration information of the system to be diagnosed; a cost setting step of setting a cost for the attack step based on at least one of information on threat information, information on attack details, and information on countermeasure possibility based on countermeasure information corresponding to the attack means; It is possible to provide an attack route extraction method, which includes an attack route extraction step of determining a priority of each attack route obtained by connecting one or more attack steps from an entry point of the system to be diagnosed to an attack target based on the cost of the attack step set in the cost setting step, and extracting the attack routes in order of highest priority.

[0012] According to a third aspect of the present invention, a computer is provided with: A process of extracting attack steps that can be performed on the system to be diagnosed according to configuration information of the system to be diagnosed; a cost setting process for setting a cost for the attack step based on at least one of threat information, attack content information, and countermeasure possibility information based on countermeasure information corresponding to the attack means; A program can be provided that executes an attack route extraction process that determines the priority of each attack route obtained by connecting one or more attack steps from an intrusion point of the system to be diagnosed to an attack target based on the cost of the attack step set in the cost setting process, and extracts the attack routes in descending order of priority. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. Effect of the Invention

[0013] According to the present invention, it is possible to provide an attack route extraction system, an attack route extraction method, and a program that contribute to extracting an attack route suitable for performing a security risk diagnosis from an attack graph. [Brief description of the drawings]

[0014] [Figure 1] 1 is a diagram illustrating an example of a schematic configuration of an attack route extraction system according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram showing an overview of a system for diagnosing security risks of a system to be diagnosed. [Diagram 3] FIG. 13 is a diagram illustrating an example of an attack graph obtained by risk analysis. [Figure 4] FIG. 1 illustrates an example of a simplified attack graph. [Diagram 5] 1 is a diagram illustrating a configuration of an example of a diagnosis target system, an example of an attack graph, and the relationship between all attack routes. [Figure 6] 1 is a diagram illustrating an example of a schematic configuration of an attack route extraction system according to a first embodiment of the present invention. [Figure 7] 1 is a diagram illustrating an example of a schematic configuration of an attack graph generation unit of an attack route extraction system according to a first embodiment of the present invention. FIG. [Figure 8] FIG. 2 is a diagram illustrating an example of the contents of information stored in a cost setting information database (DB) according to the first embodiment of the present invention. [Figure 9] 2 is a diagram illustrating an example of a schematic configuration of a cost setting unit of the attack route extraction system according to the first embodiment of the present invention. FIG. [Figure 10] FIG. 2 is a diagram illustrating an example of an overview of extraction of attack content information using an attack graph by a cost setting unit according to the first embodiment of the present invention. [Figure 11] FIG. 2 is a diagram illustrating an overview of extraction of countermeasure possibility information using an attack graph by a cost setting unit in the first exemplary embodiment of the present invention. [Figure 12] FIG. 2 is a diagram illustrating an example of costs set by a cost setting unit of the attack route extraction system according to the first embodiment of the present invention. [Figure 13] FIG. 11 is a diagram showing another example of costs set by the cost setting unit of the attack route extraction system according to the first embodiment of the present invention. [Figure 14] 1 is a diagram illustrating an example of a schematic configuration of an attack route extraction unit of an attack route extraction system according to a first embodiment of the present invention. [Figure 15] FIG. 2 is a diagram showing an output image of an attack route of the attack route extraction system according to the first embodiment of the present invention. [Figure 16]FIG. 11 is a diagram illustrating an example of a result of extracting an attack route from an attack graph according to the second embodiment of the present invention. [Figure 17] FIG. 11 is a diagram illustrating an overview of a method for extracting an attack route according to a second embodiment of the present invention. [Figure 18] FIG. 2 is a diagram showing the configuration of a computer that constitutes the attack route extraction system of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] First, an overview of one embodiment of the present invention will be described with reference to the drawings. Note that the reference numerals in the drawings attached to this overview are attached to each element for convenience as an example to aid in understanding, and are not intended to limit the present invention to the illustrated form. Furthermore, the connection lines between blocks in the drawings and the like referred to in the following description include both bidirectional and unidirectional lines. The unidirectional arrows are intended to diagrammatically indicate the flow of the main signal (data), and do not exclude bidirectionality.

[0016] 1 is a diagram showing an example of a schematic configuration of an attack route extraction system 500 according to an embodiment of the present invention. The attack route extraction system 500 according to an embodiment of the present invention includes an attack graph generation unit 510, a cost setting unit 530, and an attack route extraction unit 540.

[0017] First, the operation of the attack graph generator 510 will be described. Figure 2 is a diagram showing an overview of a system that performs security risk diagnosis of a system to be diagnosed. Configuration information of the system to be diagnosed 110 is collected (120), system information 130 is extracted, risk analysis 150 is performed by an inference engine 140, and an attack graph 160 is extracted.

[0018] FIG. 3 is a diagram showing an example of an attack graph obtained by risk analysis. In FIG. 3, the parts surrounded by thin-lined rectangles are attack conditions, the parts surrounded by ellipses are attack means, and the parts surrounded by thick-lined rectangles (nodes 210, 220, 230, 240, 250, 260, 270) indicate states (nodes). Here, each stage leading to another state (node) by an attack means is called an attack step. An attack route is a connection of each attack step (edges indicating attack means) as shown by the dashed lines in FIG. 3. That is, the attack graph here refers to a chart or diagrammatic representation showing a flow (attack route) of possible combinations of each attack step.

[0019] FIG. 4 is a diagram showing an example of a simplified attack graph. In FIG. 4, the same reference symbols as those in FIG. 3 indicate the same components. FIG. 4 shows an example of a simplified attack graph obtained by deleting the attack conditions in the part surrounded by a thin-lined square other than the states (nodes 210, 220, 230, 240, 250, 260, 270) in the part surrounded by a thick-lined square from the attack graph obtained by the risk analysis shown in FIG. 3, and by associating attack means with each edge (215, 225, 226, 235, 245, 246, 255, 265). In the following description, for the sake of simplicity, the simplified attack graph will be referred to as an attack graph, and the attack means may be omitted as appropriate.

[0020] 5 is a diagram showing an example of the configuration of a system to be diagnosed 410, an example of an image of an attack graph 420 corresponding to the configuration, and a relationship 400 of all attack routes 430. In FIG. 5, A, B, C, D, E, and F in the system to be diagnosed 410 respectively indicate hosts, and FW indicates a firewall. A and B, C and D, and E and F are connected by a network, and FW is provided between (A and B), (C and D), and (E and F), respectively, and access from A and B to C and D is permitted, and access from C and D to E and F is permitted. The attack graph 420 is extracted by analyzing the configuration information of the system to be diagnosed 410, and the attack source and attack destination nodes A, B, C, D, E, and F of the attack graph 420 correspond to the hosts A, B, C, D, E, and F in the system to be diagnosed 410. Nodes A, B, C, D, E, and F in the attack graph simply represent states (such as a state where code can be executed) reached by some attack means on the corresponding host of the diagnosed system 410. All attack routes 430 are all attack routes that are extracted from the attack graph 420 by connecting attack steps (edges), and each attack route is shown by sequentially listing the nodes.

[0021] The attack graph generation unit 510 of the attack route extraction system 500 generates an attack graph showing each attack step corresponding to each edge indicating the attack means and the state (node) reached by the attack step according to the input configuration information 501 of the system to be diagnosed. That is, the attack graph generation unit 510 is a functional unit that extracts attack steps that can be performed in the system to be diagnosed according to the configuration information of the system to be diagnosed. For example, the attack graph 420 is generated from the configuration information of one diagnosis target system 410 shown in FIG. 5. The cost setting unit 530 sets a cost for each step of the attack graph based on at least one of information of threat information, attack content information, and countermeasure possibility information based on countermeasure information corresponding to the attack means. The attack route extraction unit 540 determines the priority of each attack route obtained by connecting one or more attack steps from the intrusion point of the system to be diagnosed to the attack target based on the cost of each attack means set by the cost setting unit 530, and extracts the attack routes in order of priority.

[0022] According to one embodiment of the present invention, the priority of each attack route is determined from among all attack routes contained in an attack graph obtained from the configuration information of the system to be diagnosed, and attack routes are extracted based on the priority, making it possible to extract attack routes suitable for performing security risk diagnosis from the attack graph without enumerating all attack routes.

[0023] [First embodiment] Next, the configuration of the attack route extraction system according to the first embodiment of the present invention will be described with reference to the drawings. FIG. 6 is a diagram showing an example of a schematic configuration of the attack route extraction system according to the first embodiment of the present invention. The attack route extraction system 500 according to the first embodiment of the present invention includes an attack graph generation unit 510, a cost setting information database (DB) 520, a cost setting unit 530, and an attack route extraction unit 540. The outline of the operation of the attack route extraction system 500 according to the first embodiment of the present invention is as follows.

[0024] The attack graph generation unit 510 of the attack route extraction system 500 generates an attack graph showing each attack step corresponding to each edge indicating the attack means and the state (node) reached by the attack step according to the input configuration information 501 of the diagnosis target system. For example, the attack graph 420 is generated from the configuration information of the diagnosis target system 410 shown in FIG. 5. The cost setting information database 520 stores the countermeasure information corresponding to the threat information and the attack means. The cost setting unit 530 extracts the attack step information (attack content information) based on the attack graph, and sets the cost for each edge of the attack graph based on at least one of the countermeasure possibility information based on the threat information, the attack content information, and the countermeasure information corresponding to the attack means. The attack route extraction unit 540 determines the priority of each attack route from the intrusion point of the diagnosis target system to the attack target based on the cost of each edge set by the cost setting unit 530, and extracts the attack routes in order of the highest priority. The priority of each attack route may be determined by the attack route extraction unit 540 based on the total value of the cost of each edge on each attack route from the intrusion point to the attack target. Also, the smaller the total cost of each side is, the higher the priority may be set.

[0025] Next, the configuration and operation of each unit of the attack route extraction system 500 according to the first embodiment of the present invention will be described in detail below. Fig. 7 is a diagram showing an example of a schematic configuration of the attack graph generation unit 510 according to the first embodiment of the present invention. The attack graph generation unit 510 generates an attack graph 420 from, for example, the configuration information of the diagnosis target system 410 shown in Fig. 5.

[0026] The attack graph generation unit 510 includes a vulnerability information database (DB) 512, an analysis rule storage unit 513, an inference unit 514, and an attack graph information output unit 515. The collected configuration information 501 of the diagnosis target system includes host information included in the diagnosis target system, network configuration, OS (operation system) and software installed in each host, vulnerability information of each OS and software, data flow information, etc. The vulnerability information DB 512 stores attack conditions for each vulnerability and attack results, etc. The analysis rule storage unit 513 stores analysis rules that describe information on what kind of attack can be performed under what conditions. The inference unit 514 infers what kind of attack is possible from which host to which host based on the collected configuration information 501 of the diagnosis target system, the attack conditions for each vulnerability stored in the vulnerability information database (DB) 512, the attack results, etc., and the analysis rules stored in the analysis rule storage unit 513. The attack graph information output unit 515 outputs attack graph information 502 by combining information indicating what kind of attack is possible from which host to which host, which information was inferred by the inference unit 514. An example of the attack graph information 502 may be, for example, the attack graph shown in FIG. 4 (simplified attack graph).

[0027] FIG. 8 is a diagram showing an example of the contents of information stored in the cost setting information database (DB) 520 according to the first embodiment of the present invention. The cost setting information DB 520 stores vulnerability information 521, a threat level 523 corresponding to the attack means, countermeasure information 522 corresponding to the attack means, and the like. Here, the information included in the vulnerability information 521 and the information included in the threat level 523 are called threat information. Note that the vulnerability identifier (ID) of the vulnerability information 521 may be, for example, a Common Vulnerabilities and Exposures (CVE). Also, a Common Vulnerability Scoring System (CVSS) score, the presence or absence of an attack case, and the presence or absence of a Proof-of-Concept (PoC) code may be stored in correspondence with the vulnerability ID. In the threat level 523 corresponding to the attack means, a threat level may be set for each attack means. Also, in the countermeasure information 522 corresponding to the attack means, possible countermeasure methods may be specified for each attack means.

[0028] FIG. 9 is a diagram showing an example of a schematic configuration of the cost setting unit 530 of the attack route extraction system 500 according to the first embodiment of the present invention. The cost setting unit 530 includes an attack step information extraction unit 531, a cost calculation unit 532, and a cost allocation unit 533. The attack step information extraction unit 531 receives the attack graph information 502 output from the attack graph generation unit 510 and extracts each attack step information (attack content information) included in the attack graph information 502. The cost calculation unit 532 calculates the cost of each edge based on the attack content information extracted by the attack step information extraction unit 531, the threat information stored in the cost setting information DB 520, and at least one of the countermeasure possibility information based on the countermeasure information 522 corresponding to the attack means. The cost allocation unit 533 assigns and sets the cost calculated by the cost calculation unit 532 to each edge of the attack graph shown in FIG. 4, for example, and outputs the attack graph with cost setting 503. The setting of the cost of each edge will be described in detail below.

[0029] Next, we will explain how to set the cost of each edge of the attack graph based on the threat information, attack content information, and countermeasure possibility information based on countermeasure information 522 corresponding to the attack means. Note that, in the setting of the cost of each edge, the following explanation will be given assuming that the cost of the attack step (edge ​​of the attack graph) that is preferably output with priority is set low, but the present invention is not limited to this.

[0030] [1. Setting costs based on threat information, etc.] First, the setting of the cost of each edge of the attack graph based on threat information etc. will be described. In setting the cost based on threat information, more dangerous attack routes are preferentially extracted. As shown in Fig. 8, vulnerability information 521 and threat level 523 corresponding to the attack means are stored in the cost setting information DB 520, and based on the vulnerability information 521 and threat level 523 corresponding to the attack means, the cost of each edge of the attack graph is set by the cost allocation unit 533 of the cost setting unit 530 as follows: (1-1) Setting costs based on vulnerability information (CVSS score) The higher the CVSS score corresponding to the vulnerability ID of each edge, the lower the cost of each edge is set. (1-2) Setting costs based on the presence or absence of attacks If there is an attack example corresponding to the vulnerability ID of each edge, the cost of each edge is set low. (1-3) Setting costs based on the presence or absence of a PoC code (proof of concept code) If there is PoC code corresponding to the vulnerability ID of each edge, the cost of each edge is set low. (1-4) Setting costs based on the threat level of the attack method A threat level is set for each attack means in threat level corresponding to attack means 523. The higher the threat level of the attack means corresponding to each edge, the lower the cost of each edge is set.

[0031] [2. Extraction of attack details information] Next, prior to explaining the setting of the cost based on the attack content information, an example of an outline of the operation of extracting attack step information (attack content information) using an attack graph will be explained. Figure 10 is a diagram showing an example of an outline of the operation of extracting attack step information (attack content information) using an attack graph by the attack step information extraction unit 531 of the cost setting unit 530. Note that, for the sake of simplicity of explanation, the attack graph shown in Figure 10 shows the same attack graph as the attack graph shown in Figure 4.

[0032] (2-1) Determining attack conditions In the attack graph of FIG. 10, from the part of the attack graph in which PC A is invaded (node ​​210), vulnerability XXX of PC B is attacked (edge ​​215), and arbitrary code can be executed on PC B (node ​​220), the attack step of edge 215 is determined to be a remote attack because the source host of the attack (PC A) and the target host of the attack (PC B) are different.

[0033] (2-2) Determining authority before and after each attack step In addition, in the attack graph of Figure 10, from the part of the attack graph where arbitrary code can be executed on server C (general authority) (node ​​230), vulnerability ZZZ is attacked on server C (edge ​​235), and arbitrary code can be executed on server C (administrator authority) (node ​​240), the attack graph is constructed by dividing the nodes by authority, and the authority before and after the attack by edge 235 can be determined.

[0034] (2-3) Judging attack scenario information 10, from the part of the attack graph where arbitrary code can be executed (administrator authority) on server C (node ​​240), vulnerability VVV of server G is attacked (edge ​​246), and arbitrary code can be executed on server G (node ​​270), it is determined that the attack via edge 246 leading to the last node 270 of the attack graph is an attack step whose destination is the attack target (node ​​270). In this way, the attack step information extraction unit 531 of the cost setting unit 530 can extract attack step information (attack content information) using the attack graph.

[0035] [3. Setting costs based on attack details] Next, the setting of costs based on attack details information will be explained. In setting costs based on attack details information, a more natural attack route is preferentially extracted (a natural attack route is one that is simple and consistent). Based on the attack details information extracted using the attack graph as described above, the cost of each edge of the attack graph is set by the cost allocation unit 533 of the cost setting unit 530 as follows: (3-1) Setting the cost based on the attack conditions (remote or local) If the attack condition is determined to be a remote attack as a result of extracting attack content information using the attack graph, a higher cost is set for remote attacks (attacks from another host) than for local attacks (attacks within the same host). (3-2) Setting costs based on attack scenario information If the result of extracting attack content information using the attack graph indicates that the target of the attack is the attack target, the cost is set low. (3-3) Setting the cost based on the attacking host By adding a small cost based on the identifier of the attacked host, the same host is more likely to be selected when other conditions are the same. (3-4) Setting the cost based on the authority before and after the attack for each attack step As a result of extracting information on each attack step using the attack graph, the lower the authority required on the attacking host before the attack step, the lower the cost is set. Also, the higher the authority that can be executed after the attack of the attack step, the lower the cost is set. In particular, it is preferable to set the extracted attack route so that it appears natural.

[0036] Next, before describing the setting of the cost based on the countermeasure possibility information, an outline of the operation of extracting countermeasure possibility information based on the attack graph and the countermeasure information 522 corresponding to the attack means by the cost calculation unit 532 of the cost setting unit 530 will be described. FIG. 11 is a diagram showing an outline of the extraction of countermeasure possibility information using the attack graph by the cost calculation unit 532 of the first embodiment of the present invention. For example, the countermeasure possibility information can be extracted as follows using the attack graph shown in FIG. 11 and the countermeasure information 522 corresponding to the attack means stored in the cost setting information DB 520. Note that the attack graph shown in FIG. 11 is the same as the attack graph shown in FIG. 4, and the countermeasure information 522 corresponding to the attack means shown in FIG. 11 is the same as the countermeasure information 522 corresponding to the attack means shown in FIG. 8.

[0037] [4. Overview of countermeasure possibility information extraction operation] (4-1) Extraction of possible measures As countermeasure possibility information, the number of countermeasures that can be introduced corresponding to the attack means of each edge of the attack graph is calculated based on the countermeasure information 522 corresponding to the attack means stored in the cost setting information DB 520. In the example of Fig. 11, when the attack means is "attacking vulnerability", countermeasures include "introduction of antivirus software" and "software (SW) update", and the number of such countermeasures is regarded as the number of possible countermeasures corresponding to the attack means of the edge. Also, in the example of Fig. 11, when the attack means is "tampering with communication", countermeasures include "encryption" and "use of secure protocol", and the number of such countermeasures is regarded as the number of possible countermeasures corresponding to the attack means of the edge.

[0038] (4-2) Extracting the number of occurrences of the same attack method in the attack graph As countermeasure possibility information, we count how many times the same attack method appears for each edge in the attack graph. In the attack graph of Figure 11, the following attack methods appear the corresponding number of times. Attacking Vulnerabilities: 5 times (sides 215, 226, 235, 246, 265) Regular login: 1 time (225 sides) - Malicious file distribution: 1 time (245 sides) -Illegal file execution: 1 time (side 255)

[0039] (4-3) Extraction of the occurrence frequency of attacks that can use the same countermeasure As countermeasure possibility information, the number of occurrences of attack means that can use the same countermeasure is extracted for each edge in the attack graph. It is calculated based on the contents of the countermeasure information 522 corresponding to the attack means stored in the cost setting information DB 520, which corresponds to the attack means shown on each edge in the attack graph. In the first embodiment, for example, the following description will be given assuming that both attacking vulnerabilities and executing malicious files can be countered by installing antivirus software, but this is not limited to this. For example, in FIG. 11, the attack means that can use the installation of antivirus software are "attacking vulnerabilities" five times and "executing malicious files" once, which is a total of six times. In FIG. 11, the following attack means are counted as appearing the corresponding number of times. Vulnerability Attack: 6 times Regular login: 1 time - Malicious file distribution: 1 time - Malicious file execution: 6 times

[0040] (4-4) Extraction of the occurrence frequency of combinations of attack destination hosts and attack methods As countermeasure possibility information, the number of times that a combination of an attack destination host and an attack method appears in the attack graph is extracted. In the attack graph in Figure 11, the following combinations are counted as appearing the corresponding number of times shown as an example. In the following explanation, a combination of an attack destination host and an attack method is written as {attack method, attack destination host}. {Attack vulnerability, PC B}: 1 time (edge ​​215 and node 220) {Vulnerability attack, Server C}: 1 time (edge ​​235 and node 240) {Vulnerability attack, Server D}: 1 time (edge ​​226 and node 260) {Vulnerability attack, Server G}: 2 times (edge ​​246 and node 270, edge 265 and node 270) {Authorized login, Server C}: 1 time (edge ​​225 and node 230) {Malicious file spread, Server G}: 1 time (edge ​​245 and node 250) {Illegal file execution, server G}: 1 time (edge ​​255 and node 270)

[0041] (4-5) Extraction of the in-degree of the attacking node As countermeasure possibility information, the in-degree of the attacked node in the attack graph is extracted. In the attack graph in Figure 11, the in-degrees for the following combinations of attacked nodes and their attack methods appear the corresponding number of times. Attack vulnerability XXX on PCB: 1 entry (node ​​220) Attack vulnerability XXX on server D: 1 entry (node ​​260) · Login Server C: 1 login (node ​​230) Attack vulnerability ZZZ on server C: 1 entry (node ​​240) Attack vulnerability XXX on server G: 3 times (node ​​270) Attack vulnerability VVV on server G: 3 times (node ​​270) Malicious file distribution: 1 entry (node ​​250) - Opening a malicious executable file on server G: 3 times (node ​​270)

[0042] [5. Setting costs based on countermeasure feasibility information] The cost of each edge of the attack graph based on each of the countermeasure feasibility information extracted as above is set by the cost allocation unit 533 as follows, for example: When setting the cost based on the countermeasure feasibility information, attack routes that are easier to counter (having more countermeasure candidates or having more effective countermeasures) are preferentially extracted. (5-1) Setting costs based on the number of possible measures Based on the number of possible countermeasures extracted as described above, the cost of an edge in the attack graph is set higher as the number of possible countermeasures that can reduce the risk of the attack means increases. (5-2) Setting the cost based on the number of times the same attack method appears in the attack graph Based on the number of appearances of the same attack means extracted as above in the attack graph, the cost of the edge is set lower as the number of appearances of the same attack means in the attack graph increases. (5-3) Setting the cost based on the number of attacks that can use the same countermeasure Based on the number of occurrences of attack means that can use the same countermeasure extracted as described above, the cost of the edge is set lower as the number of occurrences of an attack means whose risk can be reduced by the same countermeasure increases in the attack graph. (5-4) Setting the cost based on the number of occurrences of the combination of the target host and the attack method Based on the frequency of occurrence of the combination of the attack destination host and the attack means extracted as described above, the cost of the edge is set lower as the frequency of occurrence of the same combination of the attack destination host and the attack means increases in the attack graph. (5-5) Setting the cost based on the in-degree of the target node Based on the in-degree of the target node extracted as above, the cost of the edge is set lower as the in-degree of the target node in the attack graph increases. In other words, the attack steps (edges) related to nodes used in many attacks are set more likely to be selected.

[0043] 12 is a diagram showing an example of the cost of each edge set by the cost setting unit 530 of the attack route extraction system 500 according to the first embodiment of the present invention. The cost 1100 can be set by, for example, associating each element of the cost setting with each digit of a decimal number.

[0044] 12 shows an example of a case where a cost is set based on threat information in each of digits 1101 to 1103 of the cost 1100, and a cost is set based on attack content information in each of digits 1104 to 1109 of the cost 1100. Note that, for example, each of digits 1101 to 1109 of the cost 1100 is set to 0 as an initial state, but is not limited to this.

[0045] Each digit 1101 to 1103 of the cost 1100 in Figure 12 is determined by combining the vulnerability information (CVSS score) of the threat information, the presence or absence of attack cases, the presence or absence of PoC code (proof of concept code), and the threat level of the attack method.If the threat level is 1, digit 1101 is set to 1, if the threat level is 2, digit 1102 is set to 1, and if the threat level is 3, digit 1103 is set to 1.

[0046] In digit 1104 of cost 1100 in Fig. 12, 1 is set based on the attack conditions in the attack content information, for example, if it is a remote attack, and in digit 1105, 1 is set based on the attack scenario information in the attack content information if the attack destination is not the attack target. In digits 1106 to 1108, a small cost is set based on the identifier of the attack destination host in the attack content information. In addition, in digit 1109, a value according to the authority before and after the attack in the attack content information is set. That is, if the authority of the attack source-attack destination is general authority-administrator authority, 0 is set, if it is administrator authority-administrator authority, 1 is set, if it is general authority-general authority, and 3 is set, if it is administrator authority-general authority.

[0047] FIG. 13 is a diagram showing another example of the cost set by the cost setting unit 530 of the attack route extraction system 500 according to the first embodiment of the present invention. The cost 1200 in FIG. 13 shows an example in which the cost is set for each digit 1101 to 1103 of the cost 1200 based on threat information, and the cost is set for each digit 1201 and 1202 of the cost 1200 based on countermeasure possibility information. In FIG. 13, the digits 1101 to 1103 of the cost 1200 are the same as the digits 1101 to 1103 of the cost 1100 set based on threat information in FIG. 12. In FIG. 13, the cost can be set for the digits 1201 and 1202 of the cost 1200 using countermeasure possibility information. That is, the countermeasure possibility information can be set based on any of the number of possible countermeasures, the number of occurrences of the same attack means in the attack graph, the number of occurrences of attack means for which the same countermeasure can be used, the number of occurrences of a combination of an attack destination host and an attack means, or the in-degree of a node, or by combining some of the countermeasure possibility information, or by integrating the countermeasure possibility information. In addition, when the cost is set to be higher as the number of times increases, the number of times may be set with an upper limit of 99. Alternatively, when the cost is set to be lower as the number of times increases, the lower limit may be set to 100-number of times with 0. In addition, the method of setting the cost is not limited to the above example and can be appropriately selected based on the object and basic solution principle of the present invention.

[0048] Next, the operation of the attack route extraction unit 540 of the attack route extraction system 500 according to the first embodiment of the present invention will be described. FIG. 14 is a diagram showing an example of a schematic configuration of the attack route extraction unit 540 of the attack route extraction system 500 according to the first embodiment of the present invention. The attack route extraction unit 540 includes a route calculation unit 541 and an attack route output unit 542.

[0049] The path calculation unit 541 of the attack route extraction unit 540 shown in Fig. 14 receives the attack graph 503 with costs set by the cost setting unit 530 shown in Fig. 9 as input, and adds up the costs of each edge on each attack route from the intrusion point to the attack target based on the costs set by the cost setting unit 530 for each "edge" connecting the nodes of the attack graph, and determines the priority (order of priority) of the attack route in ascending order of the sum. The attack route output unit 542 outputs a predetermined number of attack routes whose priorities have been determined, according to the priorities, i.e., in descending order of priority.

[0050] FIG. 15 is a diagram showing an output image in a table format of the attack route 504 of the attack route extraction system of the first embodiment of the present invention. The output image in a table format shown in FIG. 15 includes, as an example, a column 1401 showing the attack number, a column 1402 showing the information type about the attack, a column 1403 showing the specific information content for each information type, and a column 1404 showing the attack summary. In FIG. 15, the arrows indicate the progress of the attack, and as the attack progresses like the arrows, the attack route is represented by shifting each column 1402 to 1404 to the right. In addition, when the attack route is the same until halfway, the attack route is represented by branching as the arrow branches. FIG. 15 shows that it is possible to attack from No. 3 to No. 4, as indicated by the numbers in the number column 1401 on the left side of the table, or to attack from No. 3 to No. 5.

[0051] The attack route extraction system of the first embodiment of the present invention sets the cost of each attack route from all attack routes included in the attack graph obtained from the configuration information of the system to be diagnosed, determines the priority of each attack route, and extracts attack routes based on the priority, making it possible to extract attack routes suitable for performing security risk diagnosis from the attack graph without enumerating all attack routes.

[0052] [Second embodiment] Next, the configuration of the attack route extraction system according to the second embodiment of the present invention will be described with reference to the drawings. FIG. 16 is a diagram showing an example of the result of extracting an attack route from an attack graph according to the second embodiment of the present invention. In FIG. 16, when the extracted route is biased toward a specific high-risk attack route, an attack route using a low-risk attack step may not be extracted. For example, in FIG. 16, the routes from node A to node C (edge ​​1511), node C to node E (edge ​​1531), node E to node F (edge ​​1551), and node D to node E (edge ​​1542), which are indicated by thick arrows, are high-risk routes. In this case, the high-risk routes consisting of nodes A, C, E, and F, the route consisting of nodes A, C, F, and the route consisting of nodes A, C, D, E, and F are detected, but other low-risk routes may not be detected.

[0053] 17 is a diagram showing an overview of a method for extracting an attack route according to the second embodiment of the present invention. The second embodiment of the present invention is an embodiment in which, when extracting an attack route, an attack route that utilizes the attack step is extracted for each attack step. This algorithm operates as follows.

[0054] Step (1) The following steps (2) and (3) are executed for all edges e={v1, v2} in the attack graph. Note that Fig. 17 is a diagram explaining the following algorithm for one edge e={v1, v2} when v1 is node D and v2 is node E. In addition, in the following description, the cost set for each edge in the first embodiment is used to calculate the shortest path, and the shortest path means the minimum cost path calculated using the cost.

[0055] Step (2) Calculate the shortest path P passing through edge e from the intrusion s (node ​​A) to the attack target g (node ​​F). Step (2) includes the following steps (2-1) to (2-3).

[0056] Step (2-1) Calculate the shortest path P1 from the entrance s (node ​​A) to v1 that does not include g (node ​​F). If the shortest path P1 does not exist, it is determined that the shortest path P that passes through edge e does not exist.

[0057] Step (2-2) Calculate the shortest path P2 from v2 to g (node ​​F) that does not include any node included in P1. If this shortest path P2 does not exist, determine that the shortest path P that passes through edge e does not exist.

[0058] Step (2-3) If there exists a shortest path P that passes through edge e, then in step (2-3), the shortest path P that passes through edge e is set as P={P1, e, P2}.

[0059] Step (3) Finally, add the shortest path P to the attack route set.

[0060] As described above, according to the second embodiment, all attack steps that can be used in an attack can be included in any one of the attack routes.

[0061] [Third embodiment] Next, the algorithm of the third embodiment will be described. In the algorithm of the third embodiment, different cost settings may be used in the calculation of the shortest paths P1 and P2 of the second embodiment. That is, the cost settings can also be changed in the extraction of the attack route for each edge e. For example, by adding a step (4) of changing the cost as follows to the algorithm of the second embodiment, it is possible to prevent the use of a specific high-risk attack step from being overemphasized.

[0062] Step (1) For all edges e={v1, v2} in the attack graph, the following steps (2), (3), and (4) are executed. Note that in the following description, the cost set for each edge in the first embodiment is used to calculate the shortest path, and the shortest path means the minimum-cost path calculated using the cost.

[0063] Step (2) Calculate the shortest path P passing through edge e from the intrusion s (node ​​A) to the attack target g (node ​​F). Step (2) includes the following steps (2-1) to (2-3).

[0064] Step (2-1) Calculate the shortest path P1 from the entrance s (node ​​A) to v1 that does not include g (node ​​F). If the shortest path P1 does not exist, it is determined that the shortest path P that passes through edge e does not exist.

[0065] Step (2-2) Calculate the shortest path P2 from v2 to g (node ​​F) that does not include any node included in P1. If this shortest path P2 does not exist, determine that the shortest path P that passes through edge e does not exist.

[0066] Step (2-3) If there exists a shortest path P that passes through edge e, then in step (2-3), the shortest path P that passes through edge e is set as P={P1, e, P2}.

[0067] Step (3) Add the shortest path P to the set of attack routes.

[0068] Step (4) A cost Δ is added to the path of the edges included in the shortest path P. In other words, the cost of each edge included in the extracted shortest path (the attack route with the lowest cost) is changed so that the priority of each edge is lowered.

[0069] According to the third embodiment, it is possible to prevent the use of attack steps that pose a particular high risk from being overemphasized.

[0070] Although each embodiment of the present invention has been described above, the present invention is not limited to the above-mentioned embodiments, and further modifications, substitutions, and adjustments can be made without departing from the basic technical idea of ​​the present invention. For example, the network configurations, element configurations, and message expression forms shown in the drawings are examples to help understand the present invention, and the present invention is not limited to the configurations shown in these drawings. In the following description, "A and / or B" is used to mean at least either A or B.

[0071] Furthermore, the procedures shown in the above-mentioned first to third embodiments can be realized by a program that causes a computer (9000 in FIG. 18) functioning as the attack route extraction system 500 to realize the functions of the attack route extraction system 500. Such a computer is exemplified by a configuration including a CPU (Central Processing Unit) 9010, a communication interface 9020, a memory 9030, and an auxiliary storage device 9040 in FIG. 18. That is, the attack route extraction program is executed by the CPU 9010 in FIG. 18, and an update process of each calculation parameter held in the auxiliary storage device 9040 or the like is performed.

[0072] The memory 9030 is a RAM (Random Access Memory), a ROM (Read Only Memory), or the like.

[0073] In other words, each part (processing means, function) of the attack route extraction system shown in the first to third embodiments described above can be realized by a computer program that causes the processor of the computer to execute each of the above-mentioned processes using its hardware.

[0074] Finally, preferred embodiments of the present invention will be summarized. [First form] (See the first perspective attack route extraction system above) [Second Form] In the attack route extraction system according to the first embodiment, the cost setting unit extracts the attack content information based on the attack graph from which the attack steps are extracted, It is preferable that the attack route extraction unit determines a priority of each attack route based on a total value of costs of each edge on each attack route from the intrusion point to the attack target. [Third Form] In the attack route extraction system described in the first or second aspect, it is preferable that the threat information includes at least one of vulnerability information, information on the presence or absence of attack cases, information on the presence or absence of PoC (Proof-of-Concept) code, and threat level of attack means. [Fourth Form] In the attack route extraction system according to the first to third aspects, it is preferable that the attack content information includes at least one of an attack condition, attack scenario information, an identifier of the attacked host, and authority before and after the attack of each attack step. [Fifth Form] In the attack route extraction system described in the first to fourth embodiments, it is preferable that the countermeasure possibility information includes at least one of the number of introduceable countermeasures calculated based on the countermeasure information corresponding to the attack means, the number of occurrences in the attack graph from which the attack steps of the same attack means are extracted, the number of occurrences in the attack graph of attack means that can use the same countermeasure, the number of occurrences in the attack graph of combinations of attacked hosts and attack means, and the indegree of the attacked node in the attack graph. [Sixth Form] In the attack route extraction system described in the first to fifth embodiments, it is preferable that the attack route extraction unit further extracts, for each of all attack steps in the attack graph from which the attack steps are extracted, a minimum-cost attack route that includes the respective attack steps and does not include any overlapping attack steps. [7th form] The attack route extraction system according to the sixth aspect preferably changes the cost of each edge included in the extracted attack route with the minimum cost so that the priority of each edge is lowered. [8th form] (See the second perspective for attack route extraction method above) [9th form] In the attack route extraction method according to an eighth aspect, the cost setting step includes a step of extracting the attack content information based on an attack graph from which the attack steps are extracted, It is preferable that the attack route extraction step includes a step of determining a priority of each attack route based on a total value of costs of each edge on each attack route from the intrusion point to the attack target. [10th form] (See the third perspective program above) The eighth and tenth embodiments can be expanded into the second to seventh embodiments in the same manner as the first embodiment.

[0075] The disclosures of the above patent documents are incorporated herein by reference. Within the framework of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the framework of the disclosure of the present invention, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or subrange included in the range should be interpreted as being specifically described even if not otherwise specified. [Explanation of symbols]

[0076] 110, 410 Diagnostic target system 130 System Information 140 Inference Engine 150 Risk Analysis 160, 420 Attack Graph 210, 220, 230, 240, 250, 260, 270 nodes 215, 225, 226, 235, 245, 246, 255, 265 sides 430 All Attack Routes 500 Attack Route Extraction System 501 Configuration information of the system to be diagnosed 502 Attack Graph Information 503 Cost-Setting Attack Graph 510 Attack Graph Generation Unit 512 Vulnerability Information Database (DB) 513 Analysis rule storage section 514 Reasoning Department 515 Attack Graph Information Output Unit 520 Cost Setting Information Database (DB) 521 Vulnerability information 522 Countermeasure information for attack methods 523 Threat levels corresponding to attack methods 530 Cost Setting Department 531 Attack Step Information Extraction Unit 532 Cost Calculation Department 533 Cost Allocation Department 540 Attack Route Extraction Unit 541 Route Calculation Department 542 Attack route output section 1100, 1200 cost 9000 Computers 9010 CPU 9020 Communication Interface 9030 Memory 9040 Auxiliary storage device

Claims

1. A functional unit that extracts attack steps that can be performed on the system to be diagnosed according to configuration information of the system to be diagnosed; a cost setting unit that sets a cost for the attack step based on countermeasure possibility information based on countermeasure information corresponding to the attack means; an attack route extraction system including an attack route extraction unit that determines a priority of each attack route obtained by connecting one or more of the attack steps from an intrusion point of the system to be diagnosed to an attack target based on the cost of the attack step set by the cost setting unit, and extracts the attack routes in order of the priority, The countermeasure possibility information includes at least one of the number of countermeasures that can be introduced calculated based on the countermeasure information corresponding to the attack means, the number of times that the attack steps of the same attack means appear in the attack graph from which they were extracted, the number of times that attack means that can use the same countermeasure appear in the attack graph, the number of times that combinations of attacked hosts and attack means appear in the attack graph, and the indegree of the attacked node in the attack graph.

2. 2. The attack route extraction system according to claim 1, wherein the attack route extraction unit determines a priority of each attack route based on a total value of costs of each side on each attack route from the intrusion to the attack target.

3. 3. The attack route extraction system according to claim 1, wherein the attack route extraction unit further extracts, for each of all attack steps in the attack graph from which the attack steps are extracted, a minimum-cost attack route that includes the respective attack steps and does not include any overlapping attack steps.

4. 4. The attack route extraction system according to claim 3, further comprising: changing a cost of each edge included in the extracted minimum-cost attack route so that the priority of each edge is lowered.

5. A method for extracting an attack route executed by a computer having a processor and a recording device, comprising: extracting attack steps that can be performed on the system to be diagnosed according to configuration information of the system to be diagnosed; a cost setting step of setting a cost for the attack step based on countermeasure possibility information based on countermeasure information corresponding to the attack means; an attack route extraction step of determining a priority of each attack route obtained by connecting one or more of the attack steps from an intrusion point of the system to be diagnosed to an attack target based on the cost of the attack step set in the cost setting step, and extracting the attack routes in order of the priority, The countermeasure possibility information includes at least one of the number of countermeasures that can be introduced calculated based on the countermeasure information corresponding to the attack means, the number of times that the attack steps of the same attack means appear in the attack graph from which they were extracted, the number of times that attack means that can use the same countermeasure appear in the attack graph, the number of times that a combination of an attacked host and an attack means appears in the attack graph, and the indegree of the attacked node in the attack graph.

6. 6. The attack route extraction method according to claim 5, wherein the attack route extraction step includes a step of determining a priority of each attack route based on a total value of costs of each side on each attack route from the intrusion to the attack target.

7. On the computer, A process of extracting attack steps that can be performed on the system to be diagnosed according to configuration information of the system to be diagnosed; a cost setting process for setting a cost for the attack step based on countermeasure possibility information based on countermeasure information corresponding to the attack means; a program for executing an attack route extraction process that determines a priority of each attack route obtained by connecting one or more of the attack steps from an intrusion point of the system to be diagnosed to an attack target based on the cost of the attack step set in the cost setting process, and extracts the attack routes in order of the priority, The countermeasure feasibility information includes at least one of the number of countermeasures that can be introduced calculated based on the countermeasure information corresponding to the attack means, the number of times that the attack steps of the same attack means appear in the attack graph from which they are extracted, the number of times that attack means that can use the same countermeasure appear in the attack graph, the number of times that combinations of attacked hosts and attack means appear in the attack graph, and the indegree of the attacked node in the attack graph.

Images