Control device, program and control system

Abstract

To efficiently detect threat events.SOLUTION: A control apparatus comprises an attack information generation unit, a log set generation unit, and a priority calculation unit. For each of one or more threat events, the attack information generation unit generates attack information indicating a plurality of detection target attacks to be detected for detecting the one or more threat events among a plurality of attacks performed against a monitored system. For each of the plurality of detection target attacks indicated in the attack information, the log set generation unit generates, based on an attack log table indicating a detectable log capable of detecting an attack among a plurality of logs obtained from the monitored target system, a plurality of log sets each indicating a combination of one or more detectable logs capable of detecting all of the plurality of detection target attacks. The priority calculating unit calculates a priority indicating the degree of priority given to monitoring for each of the plurality of log sets.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] An embodiment of the present invention relates to a control device, a program, and a control system. [Background technology]

[0002] In recent years, cyber attacks targeting control systems have become commonplace, making security measures an urgent necessity. Among other things, log recording and monitoring are important security measures. For this reason, control systems must record a variety of logs.

[0003] The number of types of logs obtained from a control system is enormous. However, since resources for recording logs are limited, it is preferable to record fewer logs.

[0004] However, the logs that are obtained differ depending on the control system. Also, the assumed incidents and attacks that should be detected differ depending on the control system. Therefore, the logs that should be recorded differ depending on the control system.

[0005] In addition, in a control system, functions for generating and acquiring logs are limited. In addition, it is often difficult to add significant functions to many control systems, such as social infrastructure systems. For this reason, it is preferable to be able to implement maximum security measures using limited functions, taking into account the inherent constraints of the control system. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent Publication No. 2021-027505 Summary of the Invention [Problem to be solved by the invention]

[0007] The problem that the present invention seeks to solve is to mechanically output a log set that indicates one or more logs that allow efficient detection of a threat event. [Means for solving the problem]

[0008] The control device according to the embodiment includes a threat input unit, an attack information generation unit, a log set generation unit, and a priority calculation unit. Selection control section The threat input unit acquires threat information indicating one or more threat events occurring in a monitored system. The attack information generation unit generates, for each of the one or more threat events, attack information indicating a plurality of target attacks to be detected in order to detect the one or more threat events among a plurality of attacks made against the monitored system. The log set generation unit generates, for each of the plurality of target attacks indicated in the attack information, a plurality of log sets indicating a combination of one or more detectable logs capable of detecting all of the plurality of target attacks, based on an attack-log table indicating detectable logs capable of detecting attacks among a plurality of logs acquired from the monitored system. The priority calculation unit acquires, for each of the plurality of log sets, a simplicity degree indicating the smallness of constraints for monitoring each of the one or more detectable logs, and calculates, for each of the plurality of log sets, a priority indicating the degree of priority given to monitoring based on the simplicity degree of each of the one or more detectable logs. Selection control section the plurality of log sets and the priority of each of the plurality of log sets and selecting one or more log sets having a higher priority from among the plurality of log sets based on the selected one or more log sets, and recording a plurality of data for generating one or more logs indicated in the selected one or more log sets in a recording device. . [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing the configuration of a control system according to a first embodiment. [Diagram 2] FIG. 1 is a diagram showing the configuration of a log recommendation device according to a first embodiment. [Diagram 3] FIG. 1 is a diagram showing an example of a threat event. [Figure 4] FIG. 4 is a diagram showing an example of procedure information. [Diagram 5] FIG. 11 is a diagram showing a first example of attack information. [Figure 6] FIG. 13 shows a second example of attack information. [Figure 7] FIG. 13 is a diagram showing an example of an attack log database. [Figure 8] FIG. 13 is a diagram showing an example of an attack-log table. [Figure 9] FIG. 13 is a diagram showing an example of a log set. [Figure 10] FIG. [Figure 11] FIG. [Figure 12] FIG. 13 is a diagram showing an example of replacing the simplicity with a numerical value. [Figure 13] FIG. 13 is a diagram showing an example of calculation of an additional value for each constraint factor. [Figure 14] FIG. 11 is a diagram showing a first calculation example of a priority. [Figure 15] FIG. 11 is a diagram showing a second calculation example of the priority. [Figure 16] 4 is a flowchart showing a processing flow of the log recommendation device according to the first embodiment. [Figure 17] FIG. 11 is a diagram showing the configuration of a log recommendation device according to a second embodiment. [Figure 18] 10 is a flowchart showing a processing flow of a log recommendation device according to the second embodiment. [Figure 19] FIG. 2 is a diagram showing an example of a hardware configuration of a log recommendation device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0011] (First embodiment) 1 is a diagram showing the configuration of a control system 10 according to the first embodiment. The control system 10 includes a monitored system 12, a recording device 14, a monitoring device 16, and a log recommendation device 20.

[0012] The monitored system 12 is, for example, a system that controls and manages a plurality of devices. For example, the monitored system 12 is a system that controls and manages infrastructure such as roads, railways, power grids, water grids, and communication networks. The monitored system 12 may also be a plant system such as a power plant, a chemical plant, or a manufacturing plant. The monitored system 12 may also be an information processing system including one or more information processing devices.

[0013] The recording device 14 records a plurality of logs acquired from the monitored system 12. For example, the recording device 14 acquires data input to the monitored system 12, data output from the monitored system 12, data measured by devices provided in the monitored system 12, or control data for these devices, and records each of the time-series data as a log.

[0014] The monitoring device 16 monitors the multiple logs recorded in the recording device 14, and detects a threat event occurring in the monitored system 12. Furthermore, when a threat event occurs in the monitored system 12, the monitoring device 16 may analyze the multiple logs recorded in the recording device 14 to analyze factors such as why the threat event occurred. The monitoring device 16 may detect a threat event mechanically by executing a monitoring program or the like, or may detect a threat event in collaboration with an operator.

[0015] The log recommendation device 20 is an example of a control device. The log recommendation device 20 acquires threat information indicating one or more threat events to be detected by the monitoring device 16. The log recommendation device 20 also acquires constraint information indicating weights for each of a plurality of constraint factors that constrain the monitoring process for detecting the threat event. Then, the log recommendation device 20 generates a plurality of log sets based on the threat information and the constraint information. Each of the plurality of log sets indicates a combination of one or more logs to be monitored by the monitoring device 16. Furthermore, the log recommendation device 20 calculates a priority indicating a degree of priority for monitoring for each of the plurality of log sets. The priority may be a numerical value such as a score, or may be a rank. The log recommendation device 20 outputs the calculated priority in association with each of the plurality of log sets.

[0016] The log recommendation device 20 may select and output one or more log sets with higher priorities from among multiple log sets. When selecting and outputting one or more log sets with higher priorities, the log recommendation device 20 does not need to output the priorities.

[0017] The log recommendation device 20 provides the generated log sets and the priorities of each of the log sets to the monitored system 12. In this case, the monitored system 12 selects multiple pieces of data for generating one or more logs indicated in the one or more log sets with the highest priorities, and provides the selected data to the recording device 14. Then, the recording device 14 records the log of the data acquired from the monitored system 12.

[0018] The recording device 14 may provide all of the multiple data generated by the monitored system 12 to the recording device 14. In this case, the log recommendation device 20 provides the generated multiple log sets and the priorities of each of the multiple log sets to the recording device 14. Then, the recording device 14 selects data for generating one or more logs indicated in one or more log sets with higher priorities from all of the multiple data generated in the monitored system 12, and records a log of the selected data.

[0019] Fig. 2 is a diagram showing the configuration of the log recommendation device 20 according to the first embodiment. Hereinafter, the configuration of the log recommendation device 20 shown in Fig. 2 will be described with reference to Figs.

[0020] The log recommendation device 20 includes a threat input unit 32, a procedure database storage unit 34, an attack information generation unit 36, an attack-log database storage unit 38, a log set generation unit 40, a constraint database storage unit 42, a constraint input unit 44, a priority calculation unit 46, and an output unit 48.

[0021] The threat input unit 32 acquires threat information indicating one or more threat events occurring in the monitored system 12. For example, the threat input unit 32 acquires threat information input by a user such as a system administrator.

[0022] For example, as shown in Fig. 3, the threat events are important data leakage, system shutdown, system unauthorized control, etc. The threat events may be events obtained by analysis using a general threat analysis method such as STRIDE.

[0023] The procedure database storage unit 34 stores procedure information indicating attack procedures of one or more attacks performed on the monitored system 12 before a threat occurs. The log recommendation device 20 may not include the procedure database storage unit 34 and may acquire the procedure information from a database provided by a server or the like.

[0024] For example, before the threat of "system shutdown" occurs, one or more attacks are executed on the monitored system 12 by one or more attack procedures. For example, the threat of "system shutdown" occurs in the following sequence: searching for the monitored system 12, infiltrating the monitored system 12, and executing a program to shut down the monitored system 12. More specific attacks for infiltrating the monitored system 12 include obtaining a password for a remote access function and infiltrating using the obtained password, or infiltrating by exploiting a vulnerability in the program. The procedure database storage unit 34 stores procedure information indicating such specific attack procedures and attack contents.

[0025] For example, as shown in FIG. 4, the procedure database storage unit 34 may store procedure information in which attack procedures are described in a tree shape. The procedure information shown in FIG. 4 indicates that, for example, when a threat #1 occurs, an attack A or an attack B is executed. The procedure information shown in FIG. 4 indicates that, when an attack A is executed, an attack C is executed before the execution of the attack A. The procedure information shown in FIG. 4 indicates that, when an attack B is executed, an attack D or an attack E is executed before the attack B. The procedure information is generated, for example, by an analysis method called an attack tree analysis. The procedure information may be generated by using a framework for examining attack tactics such as MITRE ATT&CK, or may be generated by using a function of an attack simulation called BAS (Breach and Attack Simulation).

[0026] The attack information generation unit 36 ​​refers to the procedure information stored in the procedure database storage unit 34 and generates attack information indicating multiple target attacks that should be detected in order to detect one or more threat events input by the threat input unit 32, among multiple attacks made against the monitored system 12. The attack information is a list indicating the contents of the multiple attacks.

[0027] For example, the attack information generation unit 36 ​​may include all of the one or more attacks indicated in the procedure information for each of one or more threat events input by the threat input unit 32 in the multiple attacks to be detected indicated in the attack information.

[0028] For example, Fig. 4 shows that when threat #2 occurs, attack A and attack E or attack F are executed, and when threat #3 occurs, attack B or attack H and attack G are executed. When threat #2 and threat #3 are indicated in the threat information, the attack information generation unit 36 ​​generates attack information including attacks A, B, E, F, G, and H, as shown in Fig. 5. In this way, for each of one or more threat events, the attack information generation unit 36 ​​can include all of one or more attacks indicated in the procedure information in the multiple detection target attacks indicated in the attack information.

[0029] Also, for example, the attack information generation unit 36 ​​may include, for each of one or more threat events input by the threat input unit 32, one or more attacks among the one or more attacks indicated in the procedure information that are capable of detecting at least the target threat event, in the multiple detection target attacks indicated in the attack information.

[0030] For example, as shown in FIG. 6, when threat information indicates threat #2 and threat #3, threat #2 can be detected by analyzing attack A, and threat #3 can be detected by analyzing attack B and attack H, so the attack information generating unit 36 ​​may generate attack information including attacks A, B, and H. Also, threat #2 can be detected by analyzing attack A, and threat #3 can be detected by analyzing attack G, so the attack information generating unit 36 ​​may generate attack information including attacks A and G. Also, threat #2 can be detected by analyzing attacks E and F, and threat #3 can be detected by analyzing attacks B and H, so the attack information generating unit 36 ​​may generate attack information including attacks E, F, B, and H. Also, the monitoring device 16 can detect threat #2 by analyzing attacks E and F, and detect threat #3 by analyzing attack G, so the attack information generating unit 36 ​​may generate attack information including attacks E, F, and G. As a result, the attack information generation unit 36 ​​can include, for each of one or more threat events, one or more attacks that are capable of detecting at least the target threat event among the one or more attacks indicated in the procedure information, among the multiple detection target attacks indicated in the attack information.

[0031] The attack-log database storage unit 38 stores an attack-log database. In the attack-log database, for example, as shown in Fig. 7, a detectable log capable of detecting an attack is registered in advance for each of a plurality of attacks made against the monitored system 12.

[0032] The log set generation unit 40 generates, for each of the multiple target attacks indicated in the attack information, multiple log sets indicating one or multiple combinations of detectable logs capable of detecting all of the multiple target attacks, based on the attack-log table. The attack-log table indicates detectable logs capable of detecting an attack among the multiple logs acquired from the monitored system 12. For example, the log set generation unit 40 has an attack-log table generation unit 52 and a combination unit 54.

[0033] The attack log table generating unit 52 generates the attack log table by referring to the attack database stored in the attack log database storage unit 38. For example, as shown in Fig. 8, when attacks A, B, E, F, G, and H are included in the attack information as attacks to be detected, the attack log table generating unit 52 extracts the part related to attacks A, B, E, F, G, and H in the attack database to generate the attack log table. For example, in the attack log table in Fig. 8, log #1, log #3, and log #4 are shown as detectable logs for attack A, log #2 is shown as a detectable log for attack B, log #1 and log #2 are shown as detectable logs for attack E, log #2 is shown as a detectable log for attack F, log #2 and log #4 are shown as detectable logs for attack G, and log #1 and log #4 are shown as detectable logs for attack H.

[0034] The combination unit 54 refers to the attack-log table to detect one or more combinations of detectable logs that can detect all of the multiple target attacks, and generates multiple log sets. For example, the combination unit 54 generates at least a log set that includes one or more combinations of detectable logs that are the minimum necessary to detect all of the multiple target attacks.

[0035] With reference to the attack-log table shown in FIG. 8, it can be seen that all of the detection target attacks A, B, E, F, G, and H can be detected by analyzing the log #1 and the log #2. In this case, it is not necessary to analyze logs other than the log #1 and the log #2. With reference to the attack-log table shown in FIG. 8, it can be seen that all of the detection target attacks A, B, E, F, G, and H can be detected by analyzing the log #2 and the log #4. In this case, it is not necessary to analyze logs other than the log #2 and the log #4. Therefore, by referring to the attack-log table shown in FIG. 8, the combination unit 54 can generate a log set #1 indicating the combination of the log #1 and the log #2, and a log set #2 indicating the combination of the log #2 and the log #4, as shown in FIG. 9.

[0036] The combination unit 54 may further generate a log set by adding other logs to the minimum necessary set of one or more detectable logs. For example, the combination unit 54 may further generate log set #3 by adding log #3 to log #1 and log #2.

[0037] The constraint database storage unit 42 stores a constraint database. In the constraint database, for example, as shown in Fig. 10, a simplicity level indicating the degree of constraint for monitoring is set in advance for each of a plurality of logs and each of a plurality of constraint factors that impose constraints on the execution of a monitoring process.

[0038] The multiple constraint factors include, for example, at least one of the following: analysis difficulty, data generation amount, and analysis cost. Analysis difficulty represents a constraint such as the need for a security expert to analyze the corresponding log. Furthermore, data generation amount represents a constraint such as the need to secure a large storage area for storing logs in order to analyze the corresponding log. Analysis cost represents a constraint such as the need to introduce expensive analysis software in order to analyze the corresponding log, which is costly.

[0039] The simplicity of the analysis difficulty is larger as the log analysis is easier, and smaller as the log analysis is more difficult. For example, the simplicity of the analysis difficulty in Fig. 10 indicates that rank A indicates that the log analysis is easy, rank B indicates that the log analysis is normal, and rank C indicates that the log analysis is difficult.

[0040] The degree of simplicity for the amount of data generated is higher when the amount of data generated per unit time is smaller, and is lower when the amount of data generated is larger. For example, the degree of simplicity for the amount of data generated in Fig. 10 indicates that rank A indicates a small amount of data per unit time, rank B indicates a normal amount of data per unit time, and rank C indicates a large amount of data per unit time.

[0041] In addition, the degree of simplicity for analysis cost is higher as the cost of analyzing the log is lower, and is lower as the cost is higher. For example, the degree of simplicity for analysis cost in Fig. 10 indicates that rank A indicates a low analysis cost, rank B indicates a normal analysis cost, and rank C indicates a high analysis cost.

[0042] Although the simplicity level is expressed in three stages in the example of Fig. 10, it may be expressed in two stages. Also, the simplicity level may be expressed in four or more stages.

[0043] The constraint input unit 44 receives weights for each of the multiple constraint factors from the user. The weights are values ​​indicating the degree of importance given to the corresponding constraint factors. For example, when the multiple constraint factors include analysis difficulty, data generation amount, and analysis cost, the constraint input unit 44 receives input of weights for each of the analysis difficulty, data generation amount, and analysis cost from the user.

[0044] Furthermore, a plurality of options, each of which has a weight assigned to each of a plurality of constraint factors, may be preregistered in the constraint input unit 44. In this case, the constraint input unit 44 allows the user to select one of the plurality of options.

[0045] For example, as shown in FIG. 11, the constraint input unit 44 may register a plurality of options in which weights are assigned to each of the analysis difficulty, the amount of data generated, and the analysis cost so that the sum of the weights is 100 points. For example, an option that greatly reduces the amount of data generated is assigned a weight of 10 points to the analysis difficulty, a weight of 80 points to the amount of data generated, and a weight of 10 points to the analysis cost. Also, for example, an option that slightly reduces the analysis cost is assigned a weight of 30 points to the analysis difficulty, a weight of 30 points to the amount of data generated, and a weight of 40 points to the analysis cost. Also, for example, an option that greatly reduces the analysis cost is assigned a weight of 10 points to the analysis difficulty, a weight of 10 points to the amount of data generated, and a weight of 80 points to the analysis cost. When any of the plurality of options is selected, the constraint input unit 44 outputs the weights assigned to the selected option for each of the plurality of constraint factors.

[0046] The priority calculation unit 46 acquires a plurality of log sets generated by the log set generation unit 40. The priority calculation unit 46 acquires the simplification degree of each of one or more detectable logs for each of the plurality of log sets by referring to the constraint database. In this case, the priority calculation unit 46 acquires the simplification degree of each of one or more detectable logs for each of the plurality of constraint factors by referring to the constraint database. Then, the priority calculation unit 46 replaces the acquired simplification degrees with corresponding numerical values. For example, as shown in FIG. 12, the priority calculation unit 46 replaces rank A with 5, rank B with 2.5, and rank C with 0.

[0047] Next, the priority calculation unit 46 calculates an added value for each of the plurality of log sets by adding up the simplification degrees of one or more detectable logs for each of the plurality of constraint factors.

[0048] For example, as shown in FIG. 13, the priority calculation unit 46 calculates an added value for the analysis difficulty of the log set #1 by adding 5, which is the numerical value of the rank A of the log #1, and 2.5, which is the numerical value of the rank B of the log #2, for the data generation amount of the log set #1. The priority calculation unit 46 also calculates an added value for the data generation amount of the log set #1 by adding 2.5, which is the numerical value of the rank B of the log #1, and 2.5, which is the numerical value of the rank B of the log #2, for the analysis cost of the log set #1. The priority calculation unit 46 also calculates an added value for the analysis difficulty, the data generation amount, and the analysis cost of the log set #2.

[0049] Next, the priority calculation unit 46 acquires the weights of the multiple constraint factors received from the user from the constraint input unit 44. Then, for each of the multiple log sets, the priority calculation unit 46 calculates a priority indicating the degree of priority of monitoring based on the simplification of one or more detectable logs. For example, the priority calculation unit 46 calculates the priority by combining the simplification of one or more detectable logs for each of the multiple log sets using a predetermined arithmetic expression. For example, the priority calculation unit 46 multiplies the sum of each of the multiple constraint factors by the corresponding weight for each of the multiple log sets, and calculates a total value by summing the sums multiplied by the weights for all of the multiple constraint factors. Furthermore, the priority calculation unit 46 calculates the priority by dividing the sum by the number of one or more detectable logs for each of the multiple log sets.

[0050] 14, when an option that greatly reduces the amount of data generated is received, the priority calculation unit 46 acquires 10 points as the weight of the analysis difficulty, 80 points as the weight of the amount of data generated, and 10 points as the weight of the analysis cost. In this case, the priority calculation unit 46 calculates a total value (57.5) obtained by multiplying the value obtained by dividing the additional value of the analysis difficulty, 7.5, by 10, and multiplying the result by 10 points as the weight of the analysis difficulty, the value obtained by dividing the additional value of the amount of data generated, 5, by 10, and multiplying the result by 80 points as the weight of the amount of data generated, and the value obtained by dividing the additional value of the analysis cost, 10, by 10, and multiplying the result by 10 points as the weight of the analysis cost.

[0051] Then, the priority calculation unit 46 divides the total value (57.5) by 2, which is the number of logs included in the log set #1, to calculate the value (28.75) as the priority of the log set #1. It is considered that if the number of logs to be analyzed increases, the difficulty of analysis increases, the amount of data generated increases, and the analysis cost becomes higher. For this reason, the priority calculation unit 46 converts the total value by the number of logs to a value per log, thereby making it possible to compare the priorities between log sets regardless of the number of log sets. Furthermore, when the priority calculation unit 46 receives an option that greatly reduces the amount of data generated, it performs a similar calculation for the log set #2 to calculate a priority (33.75).

[0052] 15, when an option to slightly reduce the analysis cost is received, the priority calculation unit 46 acquires 30 points as the weight of the analysis difficulty, 30 points as the weight of the data generation amount, and 40 points as the weight of the analysis cost. In this case, the priority calculation unit 46 calculates a total value (77.5) obtained by multiplying the value obtained by dividing the additional value of the analysis difficulty, 7.5, by 10, and the weight of the analysis difficulty, 30 points (22.5), the value obtained by dividing the additional value of the data generation amount, 5, by 10, and the weight of the data generation amount, 30 points (15), and the value obtained by dividing the additional value of the analysis cost, 10, by 10, and the weight of the analysis cost, 40 points (40). Then, the priority calculation unit 46 calculates the total value (77.5) by 2, which is the number of logs included in the log set #1, as the priority of the log set #1. Furthermore, when the priority calculation unit 46 receives an option to slightly reduce the analysis cost, it performs a similar calculation for the log set #2 to calculate a priority (25).

[0053] The priority calculation unit 46 may calculate the priority by other calculation methods. The priority may be a priority order for monitoring. For example, the priority calculation unit 46 may prepare a machine learning model that has been trained in advance, input a plurality of log sets and constraint information to the machine learning model, and output the priority of each of the plurality of log sets. The priority calculation unit 46 may calculate the priority by performing a calculation that adds a parameter that increases the priority as the number of logs decreases.

[0054] The output unit 48 outputs the priorities of the multiple log sets generated by the log set generation unit 40 and the multiple log sets calculated by the priority calculation unit 46. The output unit 48 may select and output one or more log sets with higher priorities from among the multiple log sets. When selecting and outputting one or more log sets with higher priorities, the output unit 48 does not need to output the priorities.

[0055] 16 is a flowchart showing a process flow of the log recommendation device 20 according to the first embodiment. The log recommendation device 20 according to the first embodiment executes the process according to the flow shown in FIG.

[0056] First, in S11, the log recommendation device 20 acquires threat information indicating one or more threat events.

[0057] Next, in S12, the log recommendation device 20 judges whether or not there is an unprocessed threat event among one or more threat events indicated in the threat information. If there is an unprocessed threat event (Yes in S12), the log recommendation device 20 advances the process to S13.

[0058] In S13, the log recommendation device 20 sets one of one or more threat events indicated in the threat information as a threat event to be processed, and acquires procedure information indicating an attack procedure by one or more attacks for the threat event to be processed. Next, in S14, the log recommendation device 20 specifies one or more target attacks to be detected in order to detect the threat event to be processed, among one or more attacks indicated in the acquired procedure information, and adds them to the attack information. When the log recommendation device 20 finishes the process of S14, it returns the process to S12 and repeats the processes of S13 and S14 until there are no unprocessed threat events. When there are no unprocessed threat events (No in S12), the log recommendation device 20 advances the process to S15.

[0059] In S15, the log recommendation device 20 refers to the attack-log database, acquires a detectable log capable of detecting the attack for each of the multiple detection target attacks indicated in the attack information, and generates an attack-log table.

[0060] Next, in S16, the log recommendation device 20 generates a plurality of log sets, each of which indicates one or a combination of detectable logs capable of detecting all of a plurality of target attacks, based on the attack-log table.

[0061] Next, in S17, the log recommendation device 20 accepts weights of each of a plurality of constraint factors from the user. In this case, the log recommendation device 20 may allow the user to select any one option from among a plurality of options to which weights are assigned to each of a plurality of constraint factors.

[0062] Next, in S18, the log recommendation device 20 judges whether or not there is an unprocessed log set among the multiple log sets generated. If there is an unprocessed log set (Yes in S18), the log recommendation device 20 advances the process to S19.

[0063] In S19, the log recommendation device 20 selects one of the generated log sets as a log set to be processed, and calculates the priority of the log set to be processed. When the log recommendation device 20 finishes the process of S19, the log recommendation device 20 returns the process to S18 and repeats the process of S19 until there are no more unprocessed log sets. When there are no more unprocessed log sets (No in S18), the log recommendation device 20 advances the process to S20.

[0064] In S20, the log recommendation device 20 outputs the generated log sets and the priorities of the generated log sets calculated by the priority calculation unit 46 in association with each of the log sets. Alternatively, the log recommendation device 20 may select one or more log sets with higher priorities from among the generated log sets, and output the selected one or more log sets. After completing the process of S20, the log recommendation device 20 ends this flow.

[0065] According to the log recommendation device 20 of the first embodiment as described above, a log set indicating one or more logs that efficiently detect a threat event can be mechanically output. Furthermore, the log recommendation device 20 can output a log set that reduces the influence of multiple constraint factors that constrain the monitoring process. Furthermore, the log recommendation device 20 can adjust the weight that considers the influence of multiple constraint factors according to the user's setting. As a result, the log recommendation device 20 can output a log set that takes into account system-specific requirements such as analysis difficulty, data generation amount, and analysis cost. Therefore, the log recommendation device 20 can execute maximum security measures using limited functions for social infrastructure systems and the like that have large resource constraints for generating and adding logs and that have difficulty in adding significant functions.

[0066] The log recommendation device 20 can be used not only to detect threat events caused by cyber attacks before they occur, but also to analyze attacks, for example, called forensics. In this case, the log recommendation device 20 may use a log that provides sufficient information when performing forensics as a detectable log capable of detecting an attack. The log recommendation device 20 may also be used to detect threat events caused by failures before they occur, or to analyze threat events that occur due to failures. In this case, the log recommendation device 20 may change each database and the priority calculation algorithm according to the purpose of using the logs.

[0067] Second embodiment Next, a control system 10 according to a second embodiment will be described. The control system 10 according to the second embodiment has substantially the same functions and configurations as those of the first embodiment described with reference to Fig. 1 to Fig. 16, so that the components having substantially the same functions and configurations are denoted by the same reference numerals, and detailed descriptions thereof will be omitted except for the differences.

[0068] FIG. 17 is a diagram showing the configuration of a log recommendation device 20 according to the second embodiment.

[0069] The log recommendation device 20 according to the second embodiment includes an attack execution unit 62 and a log detection unit 64 instead of the attack-log database storage unit .

[0070] The attack execution unit 62 executes multiple attacks against the operating monitored system 12. For example, the attack execution unit 62 acquires an attack program or the like registered in advance in a database, and executes the acquired attack program to execute an attack against the monitored system 12. Furthermore, when there are multiple attack methods for a first attack of the multiple attacks, the attack execution unit 62 may execute the multiple attack methods simultaneously when executing the first attack.

[0071] The log detection unit 64 detects detectable logs from among the multiple logs recorded during the operation of the monitored system 12 for each of the multiple attacks executed, and generates an attack-log table. The log detection unit 64 analyzes each of the multiple logs acquired from the monitored system 12 during the attack by the attack execution unit 62, and determines whether the attack has been detected. For example, the log detection unit 64 may detect a log in which a specific character string is detected during the attack by the attack execution unit 62 as a detectable log. The log detection unit 64 may also learn data output during normal operation for each of the multiple logs, and detect a log that outputs data that has not been learned during the attack by the attack execution unit 62 as a detectable log. The log detection unit 64 may also detect a log that can detect all of the multiple attack methods as a detectable log when the attack execution unit 62 simultaneously executes multiple attack methods in the first attack.

[0072] 18 is a flowchart showing a process flow of the log recommendation device 20 according to the second embodiment. The log recommendation device 20 according to the second embodiment executes the process according to the flow shown in FIG.

[0073] First, from S11 to S14, the log recommendation device 20 executes the same processes as those in the first embodiment shown in Fig. 16. When there is no unprocessed threat event (No in S12), the log recommendation device 20 advances the process to S31.

[0074] In S31, the log recommendation device 20 judges whether there is an unexecuted target attack among the multiple target attacks indicated in the attack information. If there is an unexecuted target attack (Yes in S31), the log recommendation device 20 advances the process to S32.

[0075] In S32, the log recommendation device 20 selects one of the unexecuted detection target attacks as a target attack and executes the target attack against the monitoring target system 12 in operation. Next, in S33, the log recommendation device 20 detects a detectable log among a plurality of logs recorded during the operation of the monitoring target system 12 while the target attack is being executed. If the detectable log is detected, the log recommendation device 20 registers the detectable log in the attack-log table. After completing the process of S33, the log recommendation device 20 returns the process to S31 and repeats the processes of S32 and S33 until there are no unexecuted detection target attacks. If there are no unexecuted detection target attacks (No in S31), the log recommendation device 20 advances the process to S17.

[0076] Then, from S17 to S20, the log recommendation device 20 executes the same processes as those in the first embodiment shown in Fig. 16. When the process of S20 is completed, the log recommendation device 20 ends this flow.

[0077] In the first embodiment, an attack-log table is generated by referring to an attack-log database. However, depending on the attack, it may be difficult to determine a detectable log in advance. The log recommendation device 20 according to the second embodiment can mechanically output a log set indicating one or more logs that reliably detect a threat event, even if there is an attack for which it is difficult to determine a detectable log in advance.

[0078] (Hardware configuration) Fig. 19 is a diagram showing an example of a hardware configuration of the log recommendation device 20 according to each embodiment. The log recommendation device 20 is realized by a computer having a hardware configuration as shown in Fig. 19, for example. The log recommendation device 20 includes a CPU (Central Processing Unit) 301, a RAM (Random Access Memory) 302, a ROM (Read Only Memory) 303, an operation input device 304, a display device 305, a storage device 306, and a communication device 307. These units are connected by a bus.

[0079] The CPU 301 is a processor that executes arithmetic processing, control processing, etc. according to a program. The CPU 301 uses a predetermined area of ​​the RAM 302 as a working area and executes various processes in cooperation with programs stored in the ROM 303, the storage device 306, etc.

[0080] The RAM 302 is a memory such as a Synchronous Dynamic Random Access Memory (SDRAM), and functions as a work area for the CPU 301. The ROM 303 is a memory that stores programs and various information in a non-rewritable manner.

[0081] The operation input device 304 is an input device such as a mouse, a keyboard, etc. The operation input device 304 receives information input by a user as an instruction signal, and outputs the instruction signal to the CPU 301.

[0082] The display device 305 is a display device such as an LCD (Liquid Crystal Display), etc. The display device 305 displays various information based on a display signal from the CPU 301.

[0083] The storage device 306 is a device that writes and reads data to a semiconductor storage medium such as a flash memory, or a magnetically or optically recordable storage medium, etc. The storage device 306 writes and reads data to the storage medium in response to control from the CPU 301. The communication device 307 communicates with external devices via a network in response to control from the CPU 301.

[0084] The program executed by the computer has a modular configuration including a threat input module, an attack information generation module, a log set generation module, a constraint input module, a priority calculation module, and an output module. The program may further include an attack execution module and a log detection module.

[0085] This program is deployed on the RAM 302 and executed by the CPU 301 (processor), causing the computer to function as the threat input unit 32, the attack information generation unit 36, the log set generation unit 40, the constraint input unit 44, the priority calculation unit 46, and the output unit 48. Furthermore, this program may further cause the computer to function as the attack execution unit 62 and the log detection unit 64. Note that some or all of the threat input unit 32, the attack information generation unit 36, the log set generation unit 40, the constraint input unit 44, the priority calculation unit 46, the output unit 48, the attack execution unit 62, and the log detection unit 64 may be realized by hardware circuits. Furthermore, the RAM 302 and the storage device 306 function as the procedure database storage unit 34, the attack-log database storage unit 38, and the constraint database storage unit 42.

[0086] In addition, the program executed by the computer is provided as a file in a format that can be installed on the computer or in a format that can be executed by the computer, and is recorded on a computer-readable recording medium such as a CD-ROM, a flexible disk, a CD-R, or a DVD (Digital Versatile Disk).

[0087] This program may be stored on a computer connected to a network such as the Internet and provided by downloading it via the network. This program may be provided or distributed via a network such as the Internet. The program executed by the log recommendation device 20 may be provided by being pre-installed in the ROM 303 or the like.

[0088] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0089] 10. Control System 12 Monitored Systems 14 Recording Devices 16 Monitoring equipment 20 Log recommendation device 32 Threat Input Unit 34 Procedure database storage unit 36 Attack Information Generation Unit 38 Attack-Log Database Storage 40 Log set generator 42 Constraint database storage unit 44 Constraint Input Section 46 Priority calculation unit 48 Output section 52 Attack - Log table generator 54 Combination section 62 Attack Execution Department 64 Log detection unit

Claims

1. a threat input unit that acquires threat information indicating one or more threat events occurring in a monitored system; an attack information generation unit that generates, for each of the one or more threat events, attack information indicating a plurality of target attacks that should be detected in order to detect the one or more threat events among a plurality of attacks made against the monitored system; a log set generation unit that generates, for each of the plurality of target attacks indicated in the attack information, a plurality of log sets indicating a combination of one or a plurality of detectable logs capable of detecting the attack, based on an attack-log table indicating detectable logs capable of detecting the attack among the plurality of logs acquired from the monitored system; and a priority calculation unit that acquires, for each of the plurality of log sets, a degree of simplicity that indicates the degree of restriction for monitoring each of the one or more detectable logs, and calculates, for each of the plurality of log sets, a priority that indicates a degree of priority for monitoring based on the degree of simplicity of each of the one or more detectable logs; a selection control unit that selects one or more log sets having higher priorities from among the plurality of log sets based on the plurality of log sets and the priorities of each of the plurality of log sets, and causes a recording device to record a plurality of data for generating one or more logs indicated in the selected one or more log sets; A control device comprising:

2. The priority calculation unit acquiring the simplicity degree from a constraint database in which the simplicity degree is registered in advance for each of the plurality of logs and each of a plurality of constraint factors that impose constraints on the execution of the monitoring process; Obtaining a weight for each of the plurality of constraint factors; For each of the plurality of log sets, the priority is calculated based on a total value obtained by multiplying the sum of the simplicity degrees of the one or more detectable logs for each of the plurality of constraint factors by the corresponding weight. The control device according to claim 1 .

3. The priority calculation unit calculates, for each of the plurality of log sets, a value obtained by dividing the total value by the number of the one or more detectable logs as the priority. The control device according to claim 2.

4. a constraint input unit configured to receive the weights of the plurality of constraint factors from a user, The priority calculation unit obtains the weights of the plurality of constraint factors received from the user. The control device according to claim 2 or 3.

5. The plurality of constraint factors include at least one of analysis difficulty, data generation amount, and analysis cost; The degree of simplicity with respect to the difficulty of analysis is smaller as the analysis becomes more difficult. The degree of simplicity with respect to the amount of data generated is smaller as the amount of data generated per unit time is larger, The degree of simplicity with respect to the analysis cost is smaller as the cost of analysis is higher. A control device according to any one of claims 2 to 4.

6. The attack information generating unit generates the attack information based on procedure information indicating an attack procedure of one or more attacks performed on the monitored system before the attack occurs. A control device according to any one of claims 1 to 5.

7. The attack information generation unit includes, for each of the one or more threat events, all of the one or more attacks indicated in the procedure information in the multiple detection target attacks indicated in the attack information. The control device according to claim 6.

8. The attack information generation unit includes, for each of the one or more threat events, one or more attacks that can detect at least the target threat event among the one or more attacks indicated in the procedure information, as the multiple detection target attacks indicated in the attack information. The control device according to claim 6.

9. The log set generation unit an attack-log table generating unit that generates the attack-log table by referring to an attack-log database in which the detectable logs are registered in advance for each of a plurality of attacks made against the monitored system; a combination unit that generates the plurality of log sets by detecting a combination of the one or more detectable logs that can detect all of the plurality of target attacks by referring to the attack-log table; 9. The control device according to claim 1, further comprising:

10. an attack execution unit that executes the plurality of attacks against the monitored system in operation; a log detection unit that detects the detectable log among the plurality of logs recorded during operation of the monitored system for each of the plurality of attacks performed, and generates the attack-log table; The control device according to claim 1 , further comprising:

11. the attack execution unit, when a plurality of attack techniques exist for a first attack among the plurality of attacks, executes the plurality of attack techniques simultaneously when executing the first attack; When the first attack is executed, the log detection unit detects, from among the plurality of logs, a log capable of detecting an attack by the plurality of attack methods as the detectable log. The control device according to claim 10.

12. A program for causing an information processing device to function as a control device, The information processing device, a threat input unit that acquires threat information indicating one or more threat events occurring in a monitored system; an attack information generation unit that generates, for each of the one or more threat events, attack information indicating a plurality of target attacks that should be detected in order to detect the one or more threat events among a plurality of attacks made against the monitored system; a log set generation unit that generates, for each of the plurality of target attacks indicated in the attack information, a plurality of log sets indicating a combination of one or a plurality of detectable logs capable of detecting the attack, based on an attack-log table indicating detectable logs capable of detecting the attack among the plurality of logs acquired from the monitored system; and a priority calculation unit that acquires, for each of the plurality of log sets, a degree of simplicity that indicates the degree of restriction for monitoring each of the one or more detectable logs, and calculates, for each of the plurality of log sets, a priority that indicates a degree of priority for monitoring based on the degree of simplicity of each of the one or more detectable logs; a selection control unit that selects one or more log sets having higher priorities from among the plurality of log sets based on the plurality of log sets and the priorities of each of the plurality of log sets, and causes a recording device to record a plurality of data for generating one or more logs indicated in the selected one or more log sets; A program that makes it work.

13. A monitored system; A recording device that records a log in the monitored system; a monitoring device that monitors the log recorded in the recording device to detect a threat event occurring in the monitored system; a control device that recommends a log to be monitored by the monitoring device; Equipped with The control device includes: a threat input unit that acquires threat information indicating one or more threat events occurring in the monitored system; an attack information generation unit that generates, for each of the one or more threat events, attack information indicating a plurality of target attacks that should be detected in order to detect the one or more threat events among a plurality of attacks made against the monitored system; a log set generation unit that generates, for each of the plurality of target attacks indicated in the attack information, a plurality of log sets indicating a combination of one or a plurality of detectable logs capable of detecting the attack, based on an attack-log table indicating detectable logs capable of detecting the attack among the plurality of logs acquired from the monitored system; and a priority calculation unit that acquires, for each of the plurality of log sets, a degree of simplicity that indicates the degree of restriction for monitoring each of the one or more detectable logs, and calculates, for each of the plurality of log sets, a priority that indicates a degree of priority for monitoring based on the degree of simplicity of each of the one or more detectable logs; a selection control unit that selects one or more log sets having higher priorities from among the plurality of log sets based on the plurality of log sets and the priorities of each of the plurality of log sets, and causes the recording device to record a plurality of data for generating one or more logs indicated in the selected one or more log sets; have Control system.

Images