SECURITY ANALYSIS DEVICE, SECURITY ANALYSIS METHOD, AND PROGRAM

Abstract

A security analysis device 10 comprises a determination unit 11. The determination unit 11 searches for information that is described in a data flow diagram in a computer system to be analyzed, by using search queries corresponding to analysis rules for use in the analysis, and determines the relationship between the data flow diagram and the analysis rules on the basis of the searched information.

Description

[Technical field]

[0001] The present disclosure relates to a security analysis device and a security analysis method for performing a security check on a computer system, and further relates to a method for realizing the same. program Regarding. [Background technology]

[0002] Many computer systems are connected to the outside world via a network and are constantly exposed to threats from the outside. For this reason, penetration testing, vulnerability diagnosis, platform diagnosis, etc. have traditionally been performed when constructing a computer system.

[0003] For example, Patent Document 1 discloses a method for efficiently developing a computer system while evaluating the threat of a cyber attack. In the method disclosed in Patent Document 1, a model is created based on the design information of the target computer system, and threats are evaluated by extracting threatening data from the model.

[0004] Furthermore, in computer systems, security checks may be performed based on analysis rules. In such security checks, the analysis rules are set in advance according to the use of the computer system. The analysis rules are set, for example, by NIST-SP800-53 (guidelines for making information systems within the U.S. government more secure and for effective risk management), PCIDSS (international uniform standard for card information security), etc.

[0005] In the above-mentioned security check, first, a data flow diagram (DFD) is generated based on the specifications and operation history of the computer system. A data flow diagram is a diagram showing the flow of data in a computer system. Next, on the data flow diagram, processing such as the occurrence of processes (programs), file access, and communication that are performed in the computer system are assumed based on the specifications, use cases, operation procedures, etc. After that, using the assumed processing, it is determined whether the analysis rules are satisfied.

[0006] Examples of analysis rules include the following: -The IP addresses of hosts that do not communicate with the outside world must be private addresses. -Communication with the outside world must be via a proxy. - Filters are applied to unnecessary communications. The service network and the management network are separate. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2017-68825 A Summary of the Invention [Problem to be solved by the invention]

[0008] However, the above-mentioned security check is usually performed manually by matching the data flow diagram with the analysis rules, which places a heavy burden on the administrator of the computer system. Moreover, since the analysis rules are generally written in a general-purpose manner so that they can be applied to various systems and various use cases, it is difficult to automate the security check using a computer.

[0009] An example of the object of the present disclosure is a security analysis device, a security analysis method, and program The purpose of this invention is to provide [Means for solving the problem]

[0010] In order to achieve the above object, a security analysis device according to one aspect of the present disclosure includes: a determination unit that searches for information described in a data flow diagram in a computer system to be analyzed by using a search query corresponding to an analysis rule used for the analysis, and determines a relationship between the data flow diagram and the analysis rule based on the searched information; It is characterized by:

[0011] In order to achieve the above object, a security analysis method according to one aspect of the present disclosure includes: searching for information described in a data flow diagram in the computer system to be analyzed using a search query corresponding to the analysis rule used for the analysis, and determining a relationship between the data flow diagram and the analysis rule based on the searched information; It is characterized by:

[0012] Furthermore, in order to achieve the above object, in one aspect of the present disclosure, program teeth, On the computer, A search query corresponding to an analysis rule used for the analysis is used to search for information described in a data flow diagram in a computer system to be analyzed, and a relationship between the data flow diagram and the analysis rule is determined based on the searched information. ,child It is characterized by: Effect of the Invention

[0013] As described above, according to the present disclosure, security checks based on analysis rules in computer systems are automated. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of a security analysis device according to an embodiment. [Diagram 2] FIG. 2 is a diagram specifically showing the configuration of the security analysis device according to the embodiment. [Diagram 3] 3(a) and (b) are diagrams showing examples of data flow diagrams used in the embodiment, each showing a different data flow diagram. [Figure 4] FIG. 4 is a diagram showing an example of a management table used for managing a data flow diagram. [Diagram 5] FIG. 5 is a diagram showing an example of a management table used by the rule management unit to manage analysis rules in the embodiment. [Figure 6] FIG. 6 is a flow diagram showing the operation of the security analysis device in the embodiment. [Figure 7] FIG. 7 is a configuration diagram showing the configuration of a modified example of the security analysis device according to the embodiment. [Figure 8] FIG. 8 is a block diagram illustrating an example of a computer that realizes the security analysis apparatus according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] (Embodiment) Hereinafter, a security analysis device according to an embodiment will be described with reference to FIGS.

[0016] [Device configuration] First, a schematic configuration of a security analysis device according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a configuration diagram showing a schematic configuration of a security analysis device according to an embodiment.

[0017] 1, a security analysis device 10 according to an embodiment of the present invention is a device for performing security checks on a computer system. As shown in FIG.

[0018] First, the determination unit 11 searches for information described in a data flow diagram in a computer system to be analyzed, using a search query corresponding to an analysis rule used for the analysis. Next, the determination unit 11 determines the relationship between the data flow diagram and the analysis rule based on the searched information.

[0019] In this way, the security analysis device 10 can search the data flow diagram of a computer system and extract information related to the analysis rule, thereby automating security checks based on the analysis rule in the computer system.

[0020] Next, the security analysis device 10 in the embodiment will be described in more detail with reference to Fig. 2 to Fig. 5. Fig. 2 is a configuration diagram specifically showing the configuration of the security analysis device in the embodiment. Fig. 3(a) and (b) are diagrams showing examples of data flow diagrams used in the embodiment, each showing a different data flow diagram.

[0021] 2, in the embodiment, the security analysis device 10 includes, in addition to the above-mentioned determination unit 11, a data acquisition unit 12 and a rule management unit 13. Of these, the data acquisition unit 12 acquires a data flow diagram in a computer system to be analyzed. The data flow diagram may be created manually in advance, or may be created automatically based on data acquired from the computer system to be analyzed.

[0022] A data flow diagram, as shown in Figures 3(a) and 3(b), is a diagram that visually represents the flow of data in a computer system. A data flow diagram is composed of several symbols. In Figures 3(a) and 3(b), arrow symbols indicate data flow, and oval symbols indicate processes. Furthermore, symbols with two lines above and below indicate data accumulation, and rectangular symbols indicate external systems (sources or sinks) that send and receive external data.

[0023] Figure 3(a) shows a data flow diagram in the computer system that constitutes an EC site, and Figure 3(b) shows a data flow diagram when the browser software communicates with the Web server.

[0024] In the embodiment, the data acquisition unit 12 can acquire a data flow diagram from an external device. The source from which the data flow diagram is acquired is not particularly limited. In the embodiment, a data flow diagram is constructed for each test scenario in the computer system, and the data acquisition unit 12 acquires a data flow diagram for each test scenario. The test scenario is constructed assuming the actual operation of the computer system.

[0025] In the embodiment, the data flow diagram is managed by the management table shown in Fig. 4 at the acquisition destination. Fig. 4 is a diagram showing an example of the management table used to manage the data flow diagram. As shown in Fig. 4, the data flow diagram is managed for each test scenario. In addition, attribute information of the corresponding test scenario, specifically, meta attributes, is associated with the data flow diagram. Therefore, the data acquisition unit 12 acquires the attribute information for each test scenario in addition to the data flow diagram constructed for each test scenario.

[0026] The rule management unit 13 manages predetermined analysis rules. In the embodiment, the rule management unit 13 manages the predetermined analysis rules and attributes (meta attributes) assigned to the analysis rules using a management table. FIG. 5 is a diagram showing an example of a management table used by the rule management unit to manage analysis rules in the embodiment. As shown in FIG. 5, in the embodiment, each analysis rule and its corresponding attribute (meta attribute) are input by a user of the security analysis device 10, and the rule management unit 13 accepts the input analysis rule and attribute.

[0027] In the embodiment, the determination unit 11 compares the attributes attached to the analysis rules used in the analysis with the attribute information for each test scenario to determine a test scenario to be analyzed. Then, the determination unit 11 searches for a data flow diagram corresponding to the determined test scenario using a search query, and determines whether the data flow diagram violates the analysis rule.

[0028] Here, the determination process by the determination unit 11 will be described by giving specific examples of the analysis rules (Rules 1 to 4).

[0029] Rule1: Rule 1, for example, specifies that "the IP address of a host that does not communicate with the outside world is set to a private address."

[0030] First, the judgment unit 11 identifies the meta attribute corresponding to Rule1 from the management table managed by the rule management unit 13. Since the meta attribute is "*" (see FIG. 5), the judgment unit 11 determines all test scenarios as the test scenarios to be analyzed. Then, the judgment unit 11 acquires data flow diagrams (DFD data: see FIG. 4) corresponding to each of the test scenarios A to D from the data acquisition unit 12.

[0031] Next, the determination unit 11 executes a search using a search query corresponding to Rule1 so as to traverse all data flow diagrams corresponding to the determined test scenarios A to D, and identifies hosts that are not communicating with the outside.

[0032] Here, a host that does not communicate with the outside is a host that has only nodes or edges in the data flow diagram and communicates only with the global IP or private address of a host inside the system. Therefore, search queries in this case include global IP and private addresses (0.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255).

[0033] Then, the determination unit 11 determines whether the identified host has a global IP in any data flow diagram. If the result of the determination shows that the identified host has a global IP, the determination unit 11 determines that the data flow diagram in which the identified host exists violates Rule 1.

[0034] Rule2: Rule 2, for example, specifies that "unnecessary communications are filtered." In the following, a filter that restricts ports that allow communications in a host-level FW (firewall) will be described as an example. In addition, in the case of Rule 2, the judgment unit 11 does not judge whether or not Rule 2 is violated, but generates information required to satisfy security check items as the judgment result.

[0035] First, the judgment unit 11 identifies the meta attribute corresponding to Rule2 from the management table managed by the rule management unit 13. Since the meta attribute is "*" (see FIG. 5), the judgment unit 11 determines all test scenarios as the test scenarios to be analyzed. Then, the judgment unit 11 acquires data flow diagrams (DFD data: see FIG. 4) corresponding to each of the test scenarios A to D from the data acquisition unit 12.

[0036] Next, the determination unit 11 executes a search using a search query corresponding to Rule 2 so as to traverse all data flow diagrams corresponding to the determined test scenarios A to D, and identifies protocol port numbers occurring between each host.

[0037] Here, an example of the search query in Rule 2 is a search query that identifies all pairs of nodes indicating IP ports performing communication, excluding ephemeral ports that do not depend on protocols.

[0038] Then, the determination unit 11 outputs the identified protocol number as a permitted port number. This output port number is information required to satisfy the security check item. Therefore, the user can satisfy the check item of filtering unnecessary communications by prohibiting communications other than the obtained permitted port number.

[0039] Rule3: Rule 3, for example, prescribes that "the service network and the management network are separated."

[0040] First, the determination unit 11 identifies the meta attribute corresponding to Rule3 from the management table managed by the rule management unit 13. The meta attribute is "service and management" (see FIG. 5). Therefore, the determination unit 11 groups the test scenarios according to the meta attribute, searches for a corresponding data flow diagram for each group using a search query, and compares the search results for each group to determine the relationship between the corresponding data flow diagram and the analysis rule.

[0041] Specifically, the determination unit 11 first determines that the test scenarios whose meta attribute is “service” are test scenarios A and B. Then, the determination unit 11 acquires data flow diagrams (DFD data: see FIG. 4) corresponding to the test scenarios A and B from the data acquisition unit 12.

[0042] Then, the determination unit 11 executes a search for the data flow diagrams corresponding to the test scenarios A and B using the search query corresponding to Rule 3, and creates a list of pairs of sending IP addresses and receiving IP addresses of the communications that have occurred.

[0043] Next, the determination unit 11 determines that the test scenarios with the meta attribute “management” are test scenarios C and D. Then, the determination unit 11 acquires data flow diagrams (DFD data: see FIG. 4) corresponding to the test scenarios C and D from the data acquisition unit 12.

[0044] Furthermore, the determination unit 11 executes a search for the data flow diagrams corresponding to test scenarios C and D using a search query corresponding to Rule 3, and creates a list of pairs of sending IP addresses and receiving IP addresses of communications that have occurred.

[0045] Here, an example of the search query in Rule 3 is a search query that identifies all pairs of sending IP addresses and receiving IP addresses used in processes related to "service" or "management."

[0046] Then, based on the pair list created in relation to the meta attribute "service" and the pair list created in relation to the meta attribute "management", the judgment unit 11 identifies the sending IP address and receiving IP address that exist in both pair lists, and judges that a data flow diagram including the identified sending IP address and receiving IP address violates Rule 3.

[0047] Rule4: Rule 4, for example, specifies that "direct use of external DNS servers is prohibited."

[0048] First, the judgment unit 11 identifies the meta attribute corresponding to Rule4 from the management table managed by the rule management unit 13. Since the meta attribute is "*" (see FIG. 5), the judgment unit 11 determines all test scenarios as the test scenarios to be analyzed. Then, the judgment unit 11 acquires data flow diagrams (DFD data: see FIG. 4) corresponding to each of the test scenarios A to D from the data acquisition unit 12.

[0049] Next, the determination unit 11 searches each of the data flow diagrams of the determined test scenarios A to D, and determines the relationship between the corresponding data flow diagram and the analysis rule based on the searched information for each data flow diagram.

[0050] Specifically, the determination unit 11 executes a search using a search query corresponding to Rule 4 for each data flow diagram, and identifies communications with external DNS servers.

[0051] Here, the search query in Rule 4 may be, for example, a search query that identifies communication with an external IP address via a port of a DNS server.

[0052] Then, when the determination unit 11 identifies communication with an external DNS server, it determines that the corresponding data flow diagram violates Rule 4.

[0053] [Device operation] Next, the operation of the security analysis apparatus 10 in the embodiment will be described with reference to FIG. 6. FIG. 6 is a flow diagram showing the operation of the security analysis apparatus in the embodiment. In the following description, FIGS. 1 to 5 will be referred to as appropriate. Also, in the embodiment, a security analysis method is implemented by operating the security analysis apparatus 10. Therefore, the description of the security analysis method in the embodiment will be replaced with the following description of the operation of the security analysis apparatus 10.

[0054] As shown in FIG. 6, first, the data acquisition unit 12 acquires a data flow diagram in a computer system to be analyzed for each test scenario from an external device (step A1).

[0055] Next, the judgment unit 11 compares the attributes given to the analysis rule used in the analysis with the attribute information for each test scenario, and determines the test scenario to be analyzed (step A2).

[0056] Next, the judgment unit 11 identifies a data flow diagram that corresponds to the determined test scenario from among the data flow diagrams acquired in step A1 (step A3).

[0057] Next, the determination unit 11 executes a search for the data flow diagram identified in step A3 using a search query corresponding to the analysis rule used for the analysis (step A4).

[0058] Thereafter, the determination unit 11 determines the relationship between the data flow diagram identified in step A3 and the analysis rule based on the result of the search in step A4 (step A5).

[0059] If the analysis rule is, for example, the above-mentioned Rule 1, 3, or 4, the judgment unit 11 judges whether the data flow diagram violates the analysis rule. Also, if the analysis rule is, for example, the above-mentioned Rule 2, the judgment unit 11 creates information required to satisfy the security check item as the judgment result.

[0060] As described above, the security analysis device 10 uses a search query corresponding to the analysis rule to automatically search the data flow diagram of the computer system and extract information related to the analysis rule. The security analysis device then uses the extracted information to determine the relationship between the data flow diagram and the analysis rule. Therefore, according to the first embodiment, a security check based on the analysis rule in the computer system can be performed without manual intervention.

[0061] [program] The program in the embodiment may be any program that causes a computer to execute steps A1 to A5 shown in Fig. 6. By installing and executing this program in a computer, the security analysis device 10 and the security analysis method in the embodiment can be realized. In this case, the processor of the computer functions as the determination unit 11, the data acquisition unit 12, and the rule management unit 13 and performs the processing. Examples of the computer include a general-purpose PC, a smartphone, and a tablet terminal device.

[0062] The program in the embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the determination unit 11, the data acquisition unit 12, and the rule management unit 13.

[0063] [Variations] Next, a modified example of the security analysis apparatus 10 in the embodiment will be described with reference to Fig. 7. Fig. 7 is a configuration diagram showing the configuration of the modified example of the security analysis apparatus in the embodiment.

[0064] 7, in this modification, a security analysis device 10 is connected to a computer system 30 to be analyzed via a network. An agent program 20 is installed in the computer system 30.

[0065] Also, as shown in FIG. 7, in the modified example, the security analysis device 10 includes, instead of the data acquisition unit 12, an operation history acquisition unit 21, a meta information assignment unit 22, a data flow diagram construction unit 23, and an operation history storage unit 24.

[0066] When an analysis is requested by a user of the security analysis device 10, the operation history acquisition unit 21 instructs the agent program 20 to collect an operation history. The operation history may include an operation history of a system call, a file permission setting, and a system snapshot such as NIC (Network Interface Card) information. The operation history acquisition unit 21 stores the collected operation history data in the operation history storage unit 24.

[0067] The data flow diagram construction unit 23 acquires operation history data stored in the operation history storage unit 24, and constructs a data flow diagram for each test scenario based on the acquired data. Specifically, the data flow diagram construction unit 23 extracts processes, sources, and sinks from the operation history data in accordance with a preset test scenario. Then, the data flow diagram construction unit 23 applies the extracted information to the rules for creating a data flow diagram, and constructs a data flow diagram for each test scenario.

[0068] Data flow diagram constructing unit 23 also sets a data name for each constructed data flow diagram, associates meta attributes with each data flow diagram, and creates a management table (see FIG. 4). Data flow diagram constructing unit 23 then stores the data flow diagrams and the management table in operation history storage unit 24.

[0069] The meta information adding unit 22 adds meta attributes designated by a user to a data flow diagram constructed by the data flow diagram constructing unit 23. Note that the meta information adding unit 22 may notify the data flow diagram constructing unit 23 of the meta attributes to be added before constructing the data flow diagram.

[0070] The configurations and functions of the judgment unit 11 and the rule management unit 13 are similar to those of the above-mentioned example. In the modified example, the judgment unit 11 searches the data flow diagram constructed by the data flow diagram construction unit 23, and judges the relationship between this data flow diagram and the analysis rule based on the searched information.

[0071] According to the modified example, the process from creating a data flow diagram to determining the relationship between the data flow diagram and the analysis rules is automatically executed.

[0072] [Physical configuration] Here, a computer that realizes the security analysis apparatus 10 by executing the program in the embodiment will be described with reference to Fig. 8. Fig. 8 is a block diagram showing an example of a computer that realizes the security analysis apparatus in the embodiment.

[0073] 8, the computer 110 includes a CPU (Central Processing Unit) 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other.

[0074] Furthermore, the computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to or instead of the CPU 111. In this embodiment, the GPU or FPGA can execute the programs in the embodiments.

[0075] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and is stored in the storage device 113, into the main memory 112, and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0076] Moreover, the program in the embodiment is provided in a state stored in a computer-readable recording medium 120. The program in the embodiment may be distributed on the Internet connected via the communication interface 117.

[0077] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0078] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0079] Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0080] The security analysis device 10 in this embodiment can be realized not by a computer with a program installed, but by using hardware corresponding to each part. An example of the hardware is an electronic circuit. Furthermore, the security analysis device 10 may be realized in part by a program and the remaining part by hardware.

[0081] A part or all of the above-described embodiment can be expressed by (Additional Notes 1) to (Additional Notes 15) described below, but is not limited to the following descriptions.

[0082] (Appendix 1) a determination unit that searches for information described in a data flow diagram in a computer system to be analyzed by using a search query corresponding to an analysis rule used for the analysis, and determines a relationship between the data flow diagram and the analysis rule based on the searched information; A security analysis device comprising:

[0083] (Appendix 2) 2. A security analysis apparatus according to claim 1, The data flow diagram is constructed for each test scenario in a computer system; Attribute information for each test scenario is assigned to the data flow diagram constructed for each test scenario, The analysis rule is assigned an attribute, the determining unit compares the attributes assigned to the analysis rules used in the analysis with attribute information for each test scenario to determine a test scenario to be analyzed, and searches the data flow diagram corresponding to the determined test scenario using the search query; A security analysis device comprising:

[0084] (Appendix 3) 3. A security analysis apparatus according to claim 2, the determining unit performs a search using the search query across the data flow diagram corresponding to the determined test scenario; A security analysis device comprising:

[0085] (Appendix 4) 3. A security analysis apparatus according to claim 2, the determination unit groups the determined test scenarios based on the attributes assigned to the analysis rules used in the analysis, searches for the corresponding data flow diagrams for each group using the search query, and compares the search results for each group to determine a relationship between the corresponding data flow diagrams and the analysis rules. A security analysis device comprising:

[0086] (Appendix 5) 3. A security analysis apparatus according to claim 2, the determination unit performs a search for each of the data flow diagrams corresponding to each of the determined test scenarios, and determines a relationship between the corresponding data flow diagram and the analysis rule based on information searched for each of the data flow diagrams. A security analysis device comprising:

[0087] (Appendix 6) searching for information described in a data flow diagram in the computer system to be analyzed using a search query corresponding to the analysis rule used for the analysis, and determining a relationship between the data flow diagram and the analysis rule based on the searched information; A security analysis method comprising:

[0088] (Appendix 7) 7. The security analysis method according to claim 6, further comprising: The data flow diagram is constructed for each test scenario in a computer system; Attribute information for each test scenario is assigned to the data flow diagram constructed for each test scenario, The analysis rule is assigned an attribute, determining a test scenario to be analyzed by comparing the attribute assigned to the analysis rule used in the analysis with attribute information for each test scenario, and searching the data flow diagram corresponding to the determined test scenario using the search query; A security analysis method comprising:

[0089] (Appendix 8) 8. The security analysis method according to claim 7, further comprising: performing a search using the search query across the data flow graphs corresponding to the determined test scenarios; A security analysis method comprising:

[0090] (Appendix 9) 8. The security analysis method according to claim 7, further comprising: grouping the determined test scenarios based on the attributes assigned to the analysis rules used in the analysis, searching for the corresponding data flow diagrams for each group using the search query, and comparing the search results for each group to determine a relationship between the corresponding data flow diagrams and the analysis rules; A security analysis method comprising:

[0091] (Appendix 10) 8. The security analysis method according to claim 7, further comprising: performing a search for each of the data flow diagrams corresponding to each of the determined test scenarios, and determining a relationship between the corresponding data flow diagram and the analysis rule based on information searched for each of the data flow diagrams; A security analysis method comprising:

[0092] (Appendix 11) On the computer, A search query corresponding to an analysis rule used for the analysis is used to search for information described in a data flow diagram in a computer system to be analyzed, and a relationship between the data flow diagram and the analysis rule is determined based on the searched information. 、 Program Hmm.

[0093] (Appendix 12) As described in Appendix 11 program And, The data flow diagram is constructed for each test scenario in a computer system; Attribute information for each test scenario is assigned to the data flow diagram constructed for each test scenario, The analysis rule is assigned an attribute, determining a test scenario to be analyzed by comparing the attribute assigned to the analysis rule used in the analysis with attribute information for each test scenario, and searching the data flow diagram corresponding to the determined test scenario using the search query; Characterized by program .

[0094] (Appendix 13) As described in Appendix 12 program And, performing a search using the search query across the data flow graphs corresponding to the determined test scenarios; Characterized by program .

[0095] (Appendix 14) As described in Appendix 12 program And, grouping the determined test scenarios based on the attributes assigned to the analysis rules used in the analysis, searching for the corresponding data flow diagrams for each group using the search query, and comparing the search results for each group to determine a relationship between the corresponding data flow diagrams and the analysis rules; Characterized by program .

[0096] (Appendix 15) As described in Appendix 12 program And, performing a search for each of the data flow diagrams corresponding to each of the determined test scenarios, and determining a relationship between the corresponding data flow diagram and the analysis rule based on information searched for each of the data flow diagrams; Characterized by program .

[0097] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Industrial Applicability]

[0098] According to the present disclosure, security checks based on analysis rules in a computer system are automated. The present disclosure is useful for a computer system that executes security checks using analysis rules. [Explanation of symbols]

[0099] 10. Security Analysis Equipment 11 Judgment section 12 Data Acquisition Section 13 Rules Management Department 20 Agent Program 21 Operation history acquisition unit 22 Meta information attachment section 23 Data Flow Diagram Construction Department 24 Operation history storage section 30 Computer Systems 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. a determination unit that searches for information described in a data flow diagram in a computer system to be analyzed by using a search query corresponding to an analysis rule used for the analysis, and determines a relationship between the data flow diagram and the analysis rule based on the searched information; The data flow diagram is constructed for each test scenario in a computer system, Attribute information for each test scenario is assigned to the data flow diagram constructed for each test scenario, The analysis rule is assigned an attribute, the determining unit compares the attributes assigned to the analysis rules used in the analysis with attribute information for each test scenario to determine a test scenario to be analyzed, and searches the data flow diagram corresponding to the determined test scenario using the search query; A security analysis device comprising:

2. The security analysis device according to claim 1 , the determining unit performs a search using the search query across the data flow diagram corresponding to the determined test scenario; A security analysis device comprising:

3. The security analysis device according to claim 1 , the determination unit groups the determined test scenarios based on the attributes assigned to the analysis rules used in the analysis, searches for the corresponding data flow diagrams for each group using the search query, and compares the search results for each group to determine a relationship between the corresponding data flow diagrams and the analysis rules. A security analysis device comprising:

4. The security analysis device according to claim 1 , the determination unit performs a search for each of the data flow diagrams corresponding to each of the determined test scenarios, and determines a relationship between the corresponding data flow diagram and the analysis rule based on information searched for each of the data flow diagrams. A security analysis device comprising:

5. A computer-implemented method comprising: searching for information described in a data flow diagram in the computer system to be analyzed using a search query corresponding to an analysis rule used for the analysis, and determining a relationship between the data flow diagram and the analysis rule based on the searched information; The data flow diagram is constructed for each test scenario in a computer system, Attribute information for each test scenario is assigned to the data flow diagram constructed for each test scenario, The analysis rule is assigned an attribute, In determining the relationship between the data flow diagram and the analysis rule, the attributes assigned to the analysis rule used in the analysis are compared with attribute information for each test scenario to determine a test scenario to be analyzed, and the data flow diagram corresponding to the determined test scenario is searched for using the search query. A security analysis method comprising:

6. 6. A security analysis method according to claim 5, comprising: performing a search using the search query across the data flow graphs corresponding to the determined test scenarios; A security analysis method comprising:

7. 6. A security analysis method according to claim 5, comprising: grouping the determined test scenarios based on the attributes assigned to the analysis rules used in the analysis, searching for the corresponding data flow diagrams for each group using the search query, and comparing the search results for each group to determine a relationship between the corresponding data flow diagrams and the analysis rules; A security analysis method comprising:

8. 6. A security analysis method according to claim 5, comprising: performing a search for each of the data flow diagrams corresponding to each of the determined test scenarios, and determining a relationship between the corresponding data flow diagram and the analysis rule based on information searched for each of the data flow diagrams; A security analysis method comprising:

9. On the computer, searching for information described in a data flow diagram in a computer system to be analyzed using a search query corresponding to an analysis rule used for the analysis, and determining a relationship between the data flow diagram and the analysis rule based on the searched information; The data flow diagram is constructed for each test scenario in a computer system, Attribute information for each test scenario is assigned to the data flow diagram constructed for each test scenario, The analysis rule is assigned an attribute, In determining the relationship between the data flow diagram and the analysis rule, the attributes assigned to the analysis rule used in the analysis are compared with attribute information for each test scenario to determine a test scenario to be analyzed, and the data flow diagram corresponding to the determined test scenario is searched for using the search query. program.

10. The program according to claim 9, performing a search using the search query across the data flow graphs corresponding to the determined test scenarios; A program characterized by:

11. The program according to claim 9, grouping the determined test scenarios based on the attributes assigned to the analysis rules used in the analysis, searching for the corresponding data flow diagrams for each group using the search query, and comparing the search results for each group to determine a relationship between the corresponding data flow diagrams and the analysis rules; A program characterized by:

12. The program according to claim 9, performing a search for each of the data flow diagrams corresponding to each of the determined test scenarios, and determining a relationship between the corresponding data flow diagram and the analysis rule based on information searched for each of the data flow diagrams; A program characterized by:

Images