Cybersecurity management device, cybersecurity management method, and cybersecurity management system

Abstract

To determine priority of cyberattack in real time, on the basis of a state of the cyberattack evolving in real time, and to facilitate determination of optimal measures for minimizing damage of the cyberattack.SOLUTION: In a cybersecurity management system 200, a cybersecurity management device 250 includes: an information acquisition unit 252 which acquires attack evaluation information for evaluating cyberattack to an attack object being an object of the cyberattack; a parameter determination unit 254 which determines a time-dependent parameter which depends on time, and a non-time-dependent parameter which does not depend on the time, as an evaluation reference for evaluating the cyberattack, on the basis of the attack evaluation information; and a priority determination unit 256 which determines priority about the cyberattack, on the basis of the time-dependent parameter and the non-time-dependent parameter.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a cybersecurity management device, a cybersecurity management method, and a cybersecurity management system. [Background technology]

[0002] In recent years, cyber attacks have been evolving year by year due to the discovery of new vulnerabilities and the emergence of new attack methods. Under these circumstances, issues such as whether information systems have defensive capabilities against cyber attacks and the extent of damage that may occur when a cyber attack occurs have become important concerns for society and organizations.

[0003] In order to mitigate the damage caused by a cyber attack, a method is known in which the severity of the cyber attack is first assessed and then measures are implemented according to the severity.

[0004] For example, U.S. Patent Application Publication No. 2020 / 0007574 (Patent Document 1) describes a technology that states, "The systems, methods, and software described herein provide enhanced capabilities for implementing security actions in a computing environment. In one example, a method for operating an advice system for recommending actions in a computing environment includes identifying a security incident in the computing environment, identifying an asset criticality, and obtaining enrichment information about the security incident from one or more internal or external sources. The method also provides for identifying a severity of the security incident based on the enrichment information, and determining one or more security actions based on the enrichment information. Further, the method includes identifying an effect of the one or more security actions on the operation of the computing environment based on the criticality and the criticality, and identifying a subset of one or more security actions to respond to the security incident based on the effect." [Prior art documents] [Patent documents]

[0005] [Patent Document 1] US Patent Application Publication No. 2020 / 0007574 Summary of the Invention [Problem to be solved by the invention]

[0006] Patent Document 1 describes a means for determining security actions to be taken in response to a cyber attack based on the importance of the assets targeted by the cyber attack and the severity of the cyber attack based on the type of attack. However, in the method of Patent Document 1, security actions to respond to cyber attacks are determined based only on static information (hereinafter referred to as "non-time-dependent parameters") that does not change over time, such as the importance of the assets targeted for attack and the type of cyber attack, making it difficult to take measures against cyber attacks that take into account the evolving cyber attack situation in real time. This can result in delays in the implementation of measures to suppress cyber attacks, which can lead to greater damage from cyber attacks.

[0007] Therefore, the present disclosure aims to provide a cybersecurity management means that facilitates real-time decisions on optimal measures to minimize damage from a cyber-attack by determining the priority of a cyber-attack using not only non-time-dependent parameters but also time-dependent parameters that indicate the real-time progress of the cyber-attack. [Means for solving the problem]

[0008] In order to solve the above problems, one representative cybersecurity management device of the present disclosure includes an information acquisition unit that acquires attack evaluation information for evaluating a cyberattack against a target that is the subject of the cyberattack, a parameter determination unit that determines a time-dependent parameter that is time-dependent and a non-time-dependent parameter that is time-independent as evaluation criteria for evaluating the cyberattack based on the attack evaluation information, and a priority calculation unit that calculates a priority for the cyberattack based on the time-dependent parameters and the non-time-dependent parameters. Effect of the Invention

[0009] According to the present disclosure, it is possible to provide a cybersecurity management means that facilitates real-time decisions on optimal measures to minimize damage from a cyber-attack by determining the priority of a cyber-attack using not only non-time-dependent parameters but also time-dependent parameters that indicate the real-time progress of the cyber-attack. Other objects, configurations and effects will become apparent from the following description of the preferred embodiment of the invention. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 illustrates a computer system for implementing an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating an example of a configuration of a cybersecurity management system according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a flowchart showing the flow of data in a cybersecurity management system according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of a data configuration of the attack method table according to an embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating an example of calculation of a time interval between security events in a cyber attack. [Figure 6] FIG. 6 is a diagram illustrating an example of a data configuration of an attack speed table according to an embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram showing a specific example of an attack speed table according to an embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating an example of a data configuration of the asset information table according to the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating an example of a data configuration of the priority evaluation table according to an embodiment of the present disclosure. [Figure 10] FIG. 10 is a flowchart showing the flow of the priority determination process according to an embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram showing an asset importance confirmation screen for confirming an asset importance according to an embodiment of the present disclosure. [Figure 12] FIG. 12 is a diagram showing an attack progress confirmation screen for checking the degree of progress of a cyber-attack according to an embodiment of the present disclosure. [Figure 13] FIG. 13 is a diagram showing an attack speed confirmation screen for confirming the speed of a cyber-attack according to an embodiment of the present disclosure. [Figure 14] FIG. 14 is a diagram showing a priority confirmation screen for confirming the priority of a cyber-attack according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] As mentioned above, in recent years, cyber attacks have been evolving year by year due to the discovery of new vulnerabilities and the emergence of new attack methods, etc. Under these circumstances, issues such as whether information systems have defensive capabilities against cyber attacks and the extent of damage that may occur when a cyber attack occurs have become important issues of concern for society and organizations. In this context, a cyber attack refers to the extraction of data, tampering with data, destruction of systems, etc., and may include indiscriminate attacks and targeted attacks aimed at specific assets.

[0012] Many of the conventional countermeasures against cyber attacks are aimed at preventing cyber attacks or suppressing damage after the end of a cyber attack. The above-mentioned Patent Document 1 exists as a means for evaluating the severity of a cyber attack during the cyber attack, but in Patent Document 1, the severity is evaluated only based on non-time-dependent parameters that do not change over time, such as the importance of the assets targeted by the attack and the type of cyber attack. For this reason, it is difficult to take measures against cyber attacks that take into account the situation of cyber attacks that evolve in real time, and the implementation of measures to suppress cyber attacks may be delayed, resulting in greater damage from the cyber attack.

[0013] Therefore, the present disclosure determines the priority of a cyber-attack using not only non-time-dependent parameters but also time-dependent parameters indicating the real-time progress of the cyber-attack. For example, in an embodiment of the present disclosure, in addition to a non-time-dependent parameter such as an asset importance parameter indicating the importance of the target of attack, a time-dependent parameter such as an attack progress parameter indicating the degree of progress of the cyber-attack and a security event speed parameter indicating the progress speed of the cyber-attack may be used to determine the priority of the cyber-attack. This priority determination may be performed in real time, for example, before the cyber-attack ends. This makes it possible to determine in real time the optimal measures to minimize the damage caused by cyber attacks.

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the embodiment. In addition, in the description of the drawings, the same parts are denoted by the same reference numerals.

[0015] First, referring to Fig. 1, a computer system 100 for implementing an embodiment of the present disclosure will be described. The mechanisms and devices of the various embodiments disclosed herein may be applied to any suitable computing system. The main components of the computer system 100 include one or more processors 102, memory 104, a terminal interface 112, a storage interface 113, an I / O (input / output) device interface 114, and a network interface 115. These components may be interconnected via a memory bus 106, an I / O bus 108, a bus interface unit 109, and an I / O bus interface unit 110.

[0016] Computer system 100 may include one or more general purpose programmable central processing units (CPUs) 102A and 102B, collectively referred to as processors 102. In some embodiments, computer system 100 may include multiple processors, while in other embodiments, computer system 100 may be a single CPU system. Each processor 102 executes instructions stored in memory 104 and may include an on-board cache.

[0017] In one embodiment, memory 104 may include random access semiconductor memory, storage devices, or storage media (either volatile or non-volatile) for storing data and programs. Memory 104 may store all or a portion of the programs, modules, and data structures that implement the functions described herein. For example, memory 104 may store cybersecurity management application 150. In one embodiment, cybersecurity management application 150 may include instructions or descriptions that execute on processor 102 the functions described below.

[0018] In some embodiments, cybersecurity management application 150 may be implemented in hardware via semiconductor devices, chips, logic gates, circuits, circuit cards, and / or other physical hardware devices instead of or in addition to a processor-based system. In some embodiments, cybersecurity management application 150 may include data other than instructions or descriptions. In some embodiments, cameras, sensors, or other data input devices (not shown) may be provided to communicate directly with bus interface unit 109, processor 102, or other hardware of computer system 100.

[0019] Computer system 100 may include a bus interface unit 109 that provides communication between processor 102, memory 104, display system 124, and I / O bus interface unit 110. I / O bus interface unit 110 may couple to an I / O bus 108 for transferring data to and from various I / O units. I / O bus interface unit 110 may communicate via I / O bus 108 with multiple I / O interface units 112, 113, 114, and 115, also known as I / O processors (IOPs) or I / O adapters (IOAs).

[0020] Display system 124 may include a display controller, a display memory, or both. The display controller may provide video, audio, or both data to display device 126. Computer system 100 may also include one or more sensors or other devices configured to collect data and provide the data to processor 102.

[0021] For example, computer system 100 may include biometric sensors to collect heart rate data, stress level data, etc., environmental sensors to collect humidity data, temperature data, pressure data, etc., and motion sensors to collect acceleration data, movement data, etc. Other types of sensors may also be used. Display system 124 may be connected to a display device 126, such as a standalone display screen, a television, a tablet, or a handheld device.

[0022] The I / O interface unit provides the ability to communicate with various storage or I / O devices. For example, the terminal interface unit 112 may be attached to user I / O devices 116, such as user output devices, such as a video display, a television with speakers, and user input devices, such as a keyboard, a mouse, a keypad, a touchpad, a trackball, buttons, a light pen, or other pointing device. A user may use a user interface to enter input data or instructions to the user I / O devices 116 and the computer system 100, and receive output data from the computer system 100, by manipulating the user input devices. The user interface may be displayed on a display, played through speakers, or printed via a printer, for example, via the user I / O devices 116.

[0023] Storage interface 113 allows attachment of one or more disk drives or direct access storage device 117 (usually a magnetic disk drive storage device, but may be an array of disk drives or other storage devices configured to appear as a single disk drive). In some embodiments, storage device 117 may be implemented as any secondary storage device. Contents of memory 104 may be stored in storage device 117 and retrieved from storage device 117 as needed. I / O device interface 114 may provide an interface to other I / O devices such as printers, fax machines, etc. Network interface 115 may provide a communications path to allow computer system 100 and other devices to communicate with each other. This communications path may be, for example, network 130.

[0024] In one embodiment, computer system 100 may be a device that receives requests from other computer systems (clients) without a direct user interface, such as a multi-user mainframe computer system, a single-user system, or a server computer, etc. In other embodiments, computer system 100 may be a desktop computer, a portable computer, a laptop, a tablet computer, a pocket computer, a telephone, a smartphone, or any other suitable electronic device.

[0025] Next, with reference to FIG. 2, a configuration of a cybersecurity management system according to an embodiment of the present disclosure will be described.

[0026] Fig. 2 is a diagram illustrating an example of a configuration of a cybersecurity management system 200 according to an embodiment of the present disclosure. As illustrated in Fig. 2, the cybersecurity management system 200 includes a security agency 210, a client environment 220 including a plurality of client devices 221 to 223, a communication network 230, and a cybersecurity management device 250. The security agency 210, the client environment 220, and the cybersecurity management device 250 are connected to each other via the communication network 230. The communication network 230 here may include, for example, the Internet, a LAN (Local Area Network), a MAN (Metropolitan Area Network), a WAN (Wide Area Network), etc.

[0027] The security agency 210 is a third-party organization whose purpose is to promote cybersecurity. The security agency 210 may be a government or private organization that develops strategies to combat cyberattacks or provides various information and tools to identify and mitigate cyberattacks. For example, the security agency 210 may create and provide attack technique information for identifying the attack techniques of cyberattacks. 2, the security agency 210 may include a server device 212. The server device 212 is a device for performing information communication between the security agency 210, the client environment 220, and the cybersecurity management device 250 via the communication network 230. For example, the security agency 210 may transmit attack method information for identifying the attack method of a cyber attack to the cybersecurity management device 250 via the communication network 230.

[0028] The client environment 220 is a private network that includes computing assets that are subject to a cyber attack, where "subject" refers to a device, network, or data that is subject to a cyber attack. 2, the client environment 220 includes a plurality of client devices 221-223 as computing assets. These client devices 221-223 are computing devices included in the private network of the client environment 220, and may include any computing device, such as a server, a personal computer, a storage unit, a smartphone, etc. In addition, in the present disclosure, a case where some or all of the client devices 221-223 included in the client environment 220 are targets of a cyber attack will be described as an example. For ease of explanation, a client environment 220 including three client devices is shown as an example, but the present disclosure is not limited to this, and the number of client devices and the network configuration of the client environment 220 are arbitrary.

[0029] The cybersecurity management device 250 is a device for determining the priority of a cyberattack (for example, a cyberattack against the client environment 220). As shown in FIG. 2, the cybersecurity management device 250 includes an information acquisition unit 252, a parameter determination unit 254, a priority determination unit 256, and a memory unit 258.

[0030] The information acquisition unit 252 is a functional unit that acquires attack evaluation information for evaluating a cyber attack on an attack target of the client environment 220. For example, the information acquisition unit 252 may acquire, as the attack evaluation information, data log information indicating a security event related to the attack target, attack method information for identifying the attack method of the cyber attack, attack target information related to the attack target, and network structure information indicating the network structure including the attack target. As described later, these pieces of information may be acquired, for example, from the security organization 210 or the client environment 220 that is the attack target.

[0031] The parameter determination unit 254 is a functional unit that determines a time-dependent parameter that depends on time and a non-time-dependent parameter that does not depend on time as an evaluation criterion for evaluating a cyber-attack based on the attack evaluation information acquired by the information acquisition unit 252. Here, the time-dependent parameter means information that changes with time during the period in which a cyber-attack is being executed. On the other hand, the non-time-dependent parameter means information that does not change with time during the period in which a cyber-attack is being executed.

[0032] For example, the parameter determination unit 254 may determine an asset importance parameter indicating the importance of an attack target as a non-time-dependent parameter. The importance of an attack target according to an embodiment of the present disclosure is determined according to the rank of the attack target in the network structure, and does not change during an attack, and is therefore one of the non-time-dependent parameters. The parameter determination unit 254 may determine a progress parameter indicating the degree of progress of a cyber-attack or a speed parameter indicating the progress speed of a cyber-attack as a time-dependent parameter. The degree and speed of progress of a cyber-attack are time-dependent parameters because they may vary in real time during an attack.

[0033] In this disclosure, an example is described in which the asset importance parameter indicating the importance of the target of attack is a non-time-dependent parameter, and the progress parameter indicating the degree of progress of a cyber-attack and the speed parameter indicating the speed at which the cyber-attack progresses are time-dependent parameters; however, the present disclosure is not limited to this, and the non-time-dependent parameters and the time-dependent parameters may be selected appropriately based on the configuration of the target of attack, the nature of the cyber-attack, etc.

[0034] The priority determination unit 256 is a functional unit that calculates a priority of a cyber-attack based on the time-dependent parameters and non-time-dependent parameters determined by the parameter determination unit 254. This priority is an index showing the relative importance of a cyber-attack. This priority may be expressed as one of three levels, such as "high", "medium", and "low", or may be expressed as a value selected from a range of numbers, such as "0 to 10". In this disclosure, for convenience of explanation, a case where the priority is expressed in three stages such as "high", "medium", and "low" will be described as an example.

[0035] To determine a cyber-attack, the priority determination unit 256 uses the time-dependent parameters and non-time-dependent parameters determined by the parameter determination unit 254, and a priority evaluation table 260, which will be described later. For example, the priority determination unit 256 can determine the priority of the cyber-attack by comparing a speed parameter, a progress parameter, and an asset importance parameter with the priority evaluation table 260.

[0036] The memory unit 258 is a storage unit for storing various information used by the cybersecurity management device 250. This memory unit 258 may be any storage medium, such as a flash memory, a hard disk drive, or the like. 2, the storage unit 258 stores a priority evaluation table 260. This priority evaluation table 260 is a table that associates each of the time-independent parameters and the time-dependent parameters with a predetermined priority, and is used to determine the priority of a specific cyber-attack. The priority evaluation table 260 may be created in advance and stored in the storage unit 258, for example.

[0037] The functional units of the cybersecurity management device 250 described above may be realized by independent hardware, or may be realized as software modules in the cybersecurity management application 150 shown in FIG. 1, for example.

[0038] According to the cybersecurity management system 200 described above, the priority of a cyberattack can be determined using not only non-time-dependent parameters but also time-dependent parameters that indicate the real-time progress of a cyberattack, making it easier to make real-time decisions on optimal measures to minimize damage from a cyberattack.

[0039] Next, with reference to FIG. 3, a data flow in the cybersecurity management system according to an embodiment of the present disclosure will be described.

[0040] 3 is a flow chart illustrating data flow 300 in a cybersecurity management system 200 according to an embodiment of the present disclosure. As shown in FIG. 3, in the cybersecurity management system 200, information is communicated between a client environment 220, a cybersecurity management device 250, and a security agency 210. It should be noted that the data flow 300 shown in Figure 3 may occur during a cyber-attack, allowing priorities to be dynamically determined as the cyber-attack progresses in real-time.

[0041] First, in step S302, the client environment 220 transmits attack target information, network structure information, and data log information to the cybersecurity management device 250. The attack target information, network structure information, and data log information here may be transmitted from any of the client devices 221, 222, and 223 in the client environment 220. In one embodiment, when a cyber-attack is detected, the client environment 220 may send attack target information, network structure information, and data log information to the cybersecurity management device 250. In another embodiment, the cybersecurity management device 250 may request the network structure information and data log information from the client environment 220.

[0042] The attack target information is information that designates computing assets, such as devices, networks, or data, that are affected by a cyber attack as attack targets in the client environment 220. For example, the attack target information may designate some or all of the client devices 221, 222, and 223 as attack targets.

[0043] The network structure information is information indicating the network configuration of the client environment 220. For example, the network structure information may be information indicating each node (e.g., computing devices such as client devices 221, 222, 223, etc.) on the network of the client environment 220 and the connection paths between the nodes (so-called network topology). The network structure information may also include information indicating the role of each node on the network of the client environment 220. For example, in one embodiment, the network structure information may indicate that the role of a sensor device on the network of the client environment 220 is "raw data collection," "raw data preprocessing," "data accumulation," or "data analysis."

[0044] The data log information is information indicative of security events related to a target of a cyber attack. For example, the data log information may include the detection time of each security event, the computing assets affected, the type, and the severity. A security event here is a process to achieve the purpose of a cyber attack, such as network intrusion, data collection, system modification, etc. Generally, one cyber attack consists of one or more security events. For example, if the cyber attack is a DDoS attack, each piece of data sent to cause an overload on a server is detected as a different "security event" and recorded in the data log information.

[0045] Next, in step S304, the security agency 210 transmits the attack method information to the cybersecurity management device 250. The attack method information here may be transmitted from the server device 212 of the security agency 210. In an embodiment, the security agency 210 may transmit attack method information to the cybersecurity management device 250 in response to a request from the cybersecurity management device 250.

[0046] The attack method information here is information for identifying the attack method of a cyber attack. More specifically, this attack method information indicates attack methods that an attacker may use at each stage of a specific type of cyber attack. As an example, when a cyber attack is in the "Reconnaissance" stage, this attack method information may indicate "Active Scanning, Gather Victim Host Information, Gather Victim Identity, Gather Victim Network Information" as attack methods that an attacker may use. By using this attack method information and the data log information of the target of the attack, the attack method of the cyber attack can be identified.

[0047] Next, in step S306, the information acquisition unit of the cybersecurity management device 250 receives attack target information, network structure information, and data log information sent from the client environment 220, as well as attack method information sent from the security agency 210. Note that, although the case where various information is transmitted to the cybersecurity management device 250 is described here as an example, the present disclosure is not limited to this, and the cybersecurity management device 250 may acquire various information voluntarily.

[0048] Next, in step S308, the parameter determination unit of the cybersecurity management device 250 creates each table used when determining the priority of a cyberattack based on the various information received in step S306. For example, here, the cybersecurity parameter determination unit may create an attack method table (see FIG. 4), an attack speed table (see FIG. 6), an asset information table (see FIG. 8), and a priority evaluation table (see FIG. 9). The tables created here will be described in detail later.

[0049] Next, in step S310, the parameter determination unit of the cybersecurity management device 250 determines a time-dependent parameter that depends on time and a non-time-dependent parameter that does not depend on time as an evaluation criterion for evaluating a cyberattack based on each table created in step S308. For example, here, the cybersecurity parameter determination unit may determine an asset importance parameter that indicates the importance of the attack target as a non-time-dependent parameter based on the asset information table. Also, the cybersecurity parameter determination unit may create a progress parameter that indicates the degree of progress of a cyberattack as a time-dependent parameter based on the attack technique table. Also, the cybersecurity parameter determination unit may create a speed parameter that indicates the progress speed of a cyberattack as a time-dependent parameter based on the attack speed table.

[0050] Next, in step S312, the priority determination unit of the cybersecurity management device 250 calculates the priority of the cyberattack based on the time-dependent parameter and the non-time-dependent parameter determined in step S310. More specifically, the cybersecurity management device 250 may calculate the priority of the cyberattack by comparing the speed parameter, the progress parameter, and the asset importance parameter with a priority evaluation table.

[0051] Next, in step S314, the priority determination unit of the cybersecurity management device 250 transmits priority information indicating the priority of the cyberattack calculated in step S312 to the client environment 220. This priority information may be transmitted in real time, for example, before the cyberattack ends. This makes it possible to determine and implement optimal cyberattack countermeasures as the cyberattack progresses in real time.

[0052] Next, in step S316, if the information acquisition unit of the cybersecurity management device 250 receives additional information (e.g., the latest data log information, updated attack target information, network structure information, or attack method information), the process returns to step S306, and the additional information is processed in steps S308 to S312.

[0053] According to the data flow described above, the cybersecurity management device 250 can obtain various information for determining the priority of a cyberattack. This makes it possible to dynamically determine the priority as the cyberattack progresses in real time.

[0054] Next, an attack method table according to an embodiment of the present disclosure will be described with reference to FIG.

[0055] As described above, in the present disclosure, a progress parameter indicating the degree of progress of a cyber-attack (i.e., how far the cyber-attack has progressed at the present time) is used as one of the time-dependent parameters for determining the priority of a cyber-attack. This progress parameter is determined based on the attack method used in the security event in the cyber-attack. In addition, this attack method is identified based on the attack method table 400 created based on the attack method information obtained from the security agency and the data log information obtained from the client environment. As a rule, as a cyber attack progresses, its objectives and methods change according to predictable patterns (network intrusion, data collection, system modification), so by identifying the attack methods used in the most recent security event, it is possible to estimate the current progress of the cyber attack.

[0056] FIG. 4 is a diagram illustrating an example of an attack technique table 400 according to an embodiment of the present disclosure. As described above, this attack technique table 400 is created based on attack technique information acquired from a security agency. As shown in FIG. 4, the attack technique table 400 stores information on a progress parameter 410, an objective 412 of the attack technique, and an attack technique 414. Each attack technique 414 is classified according to the objective. For example, "Reconnaissance" and "Defense Evasion" are attack techniques for the purpose of network intrusion, and therefore are classified into the same category. Note that, although FIG. 4 shows an example of the attack method table 400, the present disclosure is not limited to this, and the configuration of the attack method table 400 (purpose of the attack method, information on the attack method, etc.) may be changed as appropriate.

[0057] In general, the purpose of security events in cyber attacks changes in the following order: network intrusion, data collection, and system modification. Therefore, an attack method whose purpose is network intrusion is performed in the early stage of a cyber attack, that is, when the cyber attack is at a low level of progress, and is therefore associated with a progress parameter of "low". An attack method whose purpose is data collection is performed in the middle stage of a cyber attack, that is, when the cyber attack is at a moderate level of progress, and is therefore associated with a progress parameter of "medium". An attack method whose purpose is system modification is performed in the late stage of a cyber attack, that is, when the cyber attack is at a high level of progress, and is therefore associated with a progress parameter of "high".

[0058] The parameter determination unit of the cybersecurity management device can identify the attack method of a specific security event in a cyberattack and determine the progress parameter associated with the attack method by using the data log information acquired from the client environment and the attack method table 400 shown in FIG. 4. More specifically, the parameter determination unit identifies the attack method of a specific security event in the data log information acquired from the client environment. The specific security event here may be any security event among the detected security events, but it is preferable to use the most recent security event in order to determine the current progress of the cyberattack. Here, in order to identify the attack method of the security event, an existing means may be used, and the present disclosure is not limited to the identification. After the attack method of the security event is identified, the parameter determination unit determines a progress parameter associated with the identified attack method by referring to the attack method table 400. As an example, when the attack method of the security event is "Exfiltration", the parameter determination unit determines the progress parameter to be "high" since the purpose of the cyber attack has progressed to the stage of changing the system, indicating a high degree of progress.

[0059] As described above, a progress parameter indicating the current progress of a cyber-attack can be determined by using the data log information acquired from the client environment and the attack technique table 400 created based on the attack technique information acquired from the security organization. By using this progress parameter, it becomes possible to determine the priority level taking into account the current progress of the cyber-attack, and it becomes easy to determine the optimal countermeasures in real time to minimize the damage caused by the cyber-attack.

[0060] Next, speed parameters according to the embodiment of the present disclosure will be described with reference to FIGS.

[0061] As described above, in the present disclosure, a speed parameter indicating a progress speed of a cyber-attack is used as one of the time-dependent parameters for determining the priority of the cyber-attack. The speed parameter is determined based on the time interval between each security event detected in the cyber-attack. First, the parameter determination unit calculates the time interval between security events based on the detection time of each security event recorded in the data log information acquired from the client environment. Here, the parameter determination unit may calculate the time interval between all security events recorded in the data log information, or may calculate the time interval between security events within a specific period.

[0062] Next, the parameter determination unit calculates a weighted average of the time intervals between each security event in the cyber attack. By comparing the weighted average of the time intervals between security events calculated in this way with a pre-created attack speed table, it is possible to determine a speed parameter that indicates the progress speed of the cyber attack.

[0063] FIG. 5 is a diagram showing an example of calculation of a time interval between security events in a cyber attack. FIG. 5 shows a timeline 500 in which security events in a specific cyber attack are arranged in chronological order. As shown in FIG. 5, five security events, namely, event 0, event 1, event 2, event 3, event 4, and event 5, are shown in this timeline 500. As described above, these security events are steps for achieving the purpose of the cyber attack (network intrusion, data collection, system modification, etc.). Each security event is performed by the same or different attack techniques.

[0064] First, the parameter determination unit specifies an analysis target period ATW including a target security event. This analysis target period ATW may be appropriately specified based on, for example, the time when a cyber attack is detected. For example, as shown in FIG. 5, the analysis target period ATW may be specified as a period including events 1 to 5, excluding event 0.

[0065] Next, the parameter determination unit calculates the time interval (TBI) of each security event in the analysis target period ATW. For example, the parameter determination unit calculates the time interval TBI between event 1 and event 2 as follows: 12、 Time interval between event 2 and event 3 TBI 23 , the time interval between event 3 and event 4 TBI 34 , and the time interval between event 4 and event 5 TBI 45 may be calculated.

[0066] Then, the parameter determination unit calculates the weighted mean time between incidents (WMTBI) of the time intervals between each security event in the cyber attack using the following formula 1.

number

[0067] In addition, the weighting w used in calculating the weighted average WMTBI of the time intervals between each security event in a cyber attack may be determined by a so-called MCDM (Multiple-criteria decision analysis) algorithm, and is not particularly limited in this disclosure.

[0068] 6 is a diagram illustrating an example of an attack speed table 600 according to an embodiment of the present disclosure. The attack speed table 600 is a table for determining a speed parameter of a cyber attack based on a weighted average WMTBI of the time interval between each security event in the cyber attack.

[0069] 6, the attack speed table 600 defines three different ranges of minimum and maximum values ​​for the weighted average WMTBI of the time interval between each security event in a cyber attack, and each range is associated with a different speed parameter. More specifically, the range of "0" to "ATW / 3-MTBI" is associated with a speed parameter of "high". The range of "ATW / 3-MTBI" to "ATW / 3+MTBI" is associated with a speed parameter of "medium". The range of "ATW / 3+MTBI" to "ATW" is associated with a speed parameter of "low". Here, a speed parameter of "high" means that the speed of a cyber attack is relatively fast, and a speed parameter of "low" means that the attack is relatively slow. Here, "ATW" is the above-mentioned analysis period, and MTBI (Mean Time Between Incidents) is the average time interval between each security event in a cyber attack. This MTBI can be calculated by, for example, setting the weighting w to 1 in Equation 1.

[0070] The speed parameter of a cyber attack can be determined by comparing the weighted average WMTBI value of the time intervals between each security event in a cyber attack calculated using Equation 1 with the ranges specified in the attack speed table 600 and determining which range it belongs to.

[0071] 7 is a diagram illustrating a specific example of an attack speed table 700 according to an embodiment of the present disclosure. As shown in FIG 7, in the attack speed table 700, three different ranges are defined by minimum and maximum values ​​for the weighted average WMTBI of the time interval between each security event in a cyber attack. More specifically, the range of "0" to "24 hours" is associated with a speed parameter of "high." The range of "24 hours" to "48 hours" is associated with a speed parameter of "medium." The range of "48 hours" to "72 hours" is associated with a speed parameter of "low." When the weighted average WMTBI value of the time interval between each security event in a cyber attack calculated by Formula 1 is within the range of "0" to "24 hours", the speed parameter of the cyber attack is determined to be "high". When the WMTBI value is within the range of "24" to "48 hours", the speed parameter of the cyber attack is determined to be "medium". When the WMTBI value is within the range of "48" to "72 hours", the speed parameter of the cyber attack is determined to be "low".

[0072] As described above, the speed parameter indicating the progress speed of a cyber-attack can be determined by calculating the time interval between security events based on the detection time of each security event recorded in the data log information acquired from the client environment and comparing the calculated time interval between security events with the attack speed table. By using this speed parameter, it is possible to determine the priority taking into account the speed at which the cyber-attack is progressing, and it becomes easy to make a real-time decision on the optimal countermeasure to minimize the damage caused by the cyber-attack.

[0073] Next, with reference to FIG. 8, an asset information table according to an embodiment of the present disclosure will be described.

[0074] As described above, in the present disclosure, an asset importance parameter indicating the importance of an attack target is used as one of the non-time-dependent parameters for determining the priority of a cyber-attack. This asset importance parameter is determined based on an asset information table 800 created from network structure information acquired from a client environment. FIG. 8 is a diagram illustrating an example of the asset information table 800 according to an embodiment of the present disclosure.

[0075] As described above, the asset information table 800 is created based on network structure information obtained from the client environment, and may include, for each computing asset (computing device, storage device, etc.) that constitutes the network, an asset name 802 indicating the landmark of the computing asset, an asset ID 804 indicating an identifier of the computing asset, an IP address 806 indicating the IP address of the computing asset, a MAC address 808 indicating the MAC address of the computing asset, a gateway 810 indicating the gateway address of the computing asset, and a network class 812 indicating the network class of the computing asset, as shown in FIG. 8 .

[0076] The network hierarchy 812 is information indicating the logical position of a particular computing asset in a network, for example, based on the role of the computing asset. In one embodiment, the network hierarchy of a computing asset may be divided into five levels as follows: Level 0: Devices with physical interfaces such as sensors, relays, connectors, etc. Level 1: Devices for controlling Level 1 devices, such as RTU (Remote Terminal Unit), PLC (Programmable Logic Controller), etc. Level 2: Devices for controlling Level 2 devices, such as HMI (Human Machine Interface), Supervisory Control Unit, Communication Processor, Real Time Database, etc. Level 3: Devices used for IT management, operations management, and systems administration, such as web service servers, firewalls, and application databases. Level 4: Devices for managing application business planning and logistics information such as ICS (Integrated Computer Solutions) web clients and ICS business application clients

[0077] In principle, the higher the level of the network hierarchy, the more important the computing asset is in the network. Therefore, in the present disclosure, the parameter determination unit can determine an importance parameter indicating the importance of the target computing asset based on the network hierarchy of the target computing asset.

[0078] More specifically, the parameter determination unit determines the network class of the computing asset that is the target of the attack by comparing the attack target information acquired from the client environment with the asset information table 800 created based on the network structure information acquired from the client environment. Then, the parameter determination unit determines which of the three importance parameter levels, "high", "medium", or "low", the network class of the computing asset that is the target of the attack corresponds to based on a predetermined criterion. As an example, in one embodiment, an attack target with a network class of level 1 may have an asset importance parameter of "low," an attack target with a network class of level 2 or 3 may have an asset importance parameter of "medium," and an attack target with a network class of level 4 may have an asset importance parameter of "high." Here, an asset importance parameter of "low" means that the computing asset has a relatively low importance in the network, and an asset importance parameter of "high" means that the computing asset has a relatively high importance in the network.

[0079] As described above, by comparing the attack target information acquired from the client environment with the asset information table 800 created based on the network structure information acquired from the client environment, it is possible to determine the importance parameter indicating the importance of the network asset in accordance with the network class of the computing asset that is the target of the attack. By using this asset importance parameter, it is possible to determine the priority taking into account the importance of the computing asset that is the target of the attack in the network, and it becomes easy to make a real-time decision on the optimal measures to minimize the damage caused by a cyber attack.

[0080] Next, a priority evaluation table according to an embodiment of the present disclosure will be described with reference to FIG.

[0081] As described above, in the embodiment of the present disclosure, the priority of a cyber-attack is determined based on the speed parameter, progress parameter, and asset importance parameter determined by the above-mentioned parameter determination unit, and the priority evaluation table 260. This priority evaluation table 260 is a table that associates the speed parameter, progress parameter, and asset importance parameter with the priority of a cyber-attack, and is used to determine the priority of a specific cyber-attack. The priority evaluation table 260 may be created in advance based on, for example, the criteria of an administrator of the client environment, and stored in the storage unit of the cybersecurity management device.

[0082] Fig. 9 is a diagram illustrating an example of a priority evaluation table 260 according to an embodiment of the present disclosure. As illustrated in Fig. 9, the priority evaluation table 260 stores information on a progress parameter 262, a speed parameter 264, an asset importance parameter 266, and a priority 268. More specifically, the priority evaluation table 260 shows a corresponding priority 268 for each of the progress parameter 262, the speed parameter 264, and the asset importance parameter 266 at three stages, namely, "high," "medium," and "low." Note that, although FIG. 9 shows an example of priority evaluation table 260, the present disclosure is not limited to this, and the configuration of priority evaluation table 260 (such as the correspondence between various parameters and priority levels) may be changed as appropriate.

[0083] After the speed parameters, progress parameters, and asset importance parameters have all been determined for a particular cyber-attack, the priority determination unit of the cybersecurity management device can determine the priority of the cyber-attack by using these parameters and the priority evaluation table 260. More specifically, the priority determination unit identifies an element in the priority evaluation table 260 that corresponds to the determined values ​​of the speed parameters, progress parameters, and asset importance parameters, and determines the value described in the identified element as the priority of the cyber-attack. As an example, if the progress parameter 262 for a particular cyber attack is determined to be "medium," the speed parameter 264 is determined to be "low," and the asset importance parameter 266 is determined to be "high," the priority 268 for that cyber attack is determined to be "medium."

[0084] In this way, by using the speed parameter, the progress parameter, the asset importance parameter, and the priority evaluation table, the priority of the cyber-attack is determined not only by non-time-dependent parameters but also by time-dependent parameters that indicate the real-time progress of the cyber-attack. By using the speed parameter, the progress parameter, and the asset importance parameter, it becomes possible to determine the priority taking into account the current progress of the cyber-attack, the speed at which the cyber-attack is progressing, and the importance of the computing asset targeted by the attack in the network, making it easy to determine the optimal measures to minimize the damage caused by the cyber-attack in real time.

[0085] Next, with reference to FIG. 10, a flow of priority determination processing according to an embodiment of the present disclosure will be described.

[0086] 10 is a flowchart showing a flow of a priority determination process 1000 according to an embodiment of the present disclosure. The priority determination process 1000 is a process for determining the priority of a cyber-attack, and is performed by, for example, each functional unit of the cybersecurity management device shown in FIG.

[0087] First, in step S1004, an information acquisition unit (for example, the information acquisition unit 252 shown in FIG. 2) of the cybersecurity management device receives data log information. Here, the information acquisition unit The data log information may be obtained from the client environment described above. The data log information is information indicative of security events related to targets of cyber attacks. For example, the data log information may include the detection time of each security event, the computing device affected, the type, the severity, etc.

[0088] Next, in step S1006, a parameter determination unit (for example, parameter determination unit 254 shown in FIG. 2) of the cybersecurity management device analyzes the data log information received in step S1004 and detects a security event corresponding to the cyberattack. As described above, a security event here is a process for achieving the purpose of a cyberattack. Generally, one cyberattack consists of one or more security events. For example, if the cyberattack is a DDoS attack, each piece of data sent to cause an excessive load on the server is detected as a different "security event" and recorded in the data log information.

[0089] Next, in step S1008, the parameter determination unit determines a progress parameter indicating the current degree of progress of the cyber attack by using the data log information obtained from the client environment and an attack method table created based on the attack method information 1005 obtained from the security agency. Incidentally, since the details of determining the progress parameter have been explained with reference to FIG. 4, the explanation thereof will be omitted here.

[0090] Next, in step S1010, the parameter determination unit determines an importance parameter indicating the importance of the attack target based on the attack target information and network structure information 1015 acquired from the client environment. The details of determining the importance parameter have been described with reference to FIG. 8, and therefore will not be described here.

[0091] Next, in step S1012, the parameter determination unit calculates the time interval between security events based on the detection time of each security event recorded in the data log information acquired from the client environment in step S1004. The details of calculating the time interval between security events have been described with reference to FIG. 5, and therefore will not be described here.

[0092] Next, in step S1014, the parameter determination unit determines a speed parameter indicating the speed of the cyber attack based on the time interval between security events calculated in step S1012 and the attack speed table 600. Incidentally, since the details of determining the speed parameter have already been described with reference to Figs. 6 to 7, the description thereof will be omitted here.

[0093] Next, in step S1016, a priority determination unit of the cybersecurity management device (for example, the priority determination unit 256 shown in FIG. 2) determines the priority of the cyberattack using the progress parameter determined in step S1008, the asset importance parameter determined in step S1010, the speed parameter determined in step S1014, and a priority evaluation table 260 created in advance. Details of determining the priority of a cyber attack using progress parameters, asset importance parameters, speed parameters, and priority evaluation table 260 have been explained with reference to Figure 9, so they will not be explained here.

[0094] Next, in step S1018, the priority determination unit transmits priority information indicating the priority of the cyber-attack calculated in step S1016 to the client environment. This priority information may be transmitted in real time, for example, before the cyber-attack ends. This allows optimal cyber-attack countermeasures to be determined and implemented as the cyber-attack progresses in real time.

[0095] Next, in step S1020, if the information acquisition unit receives additional information (e.g., the latest data log information, updated attack target information, network structure information, or attack method information), the process returns to step S1004, and the additional information is processed in steps S1006 to S1016.

[0096] According to the priority determination process 1000 described above, the priority of a cyber-attack can be determined using not only non-time-dependent parameters but also time-dependent parameters that indicate the real-time progress of the cyber-attack, making it easier to determine the optimal measures to minimize the damage caused by the cyber-attack.

[0097] Next, a user interface according to an embodiment of the present disclosure will be described with reference to Figures 11 to 14. Each of the screens shown in Figures 11 to 14 may be displayed on a display (not shown in Figure 2) connected to the cybersecurity management device 250 or the client environment 220.

[0098] 11 is a diagram showing an asset importance confirmation screen 1100 for confirming asset importance according to an embodiment of the present disclosure. As shown in FIG. 11, the asset importance confirmation screen 1100 includes a network configuration window 1110, a screen switching window 1120, and a data log information table 1130.

[0099] The network configuration window 1110 displays the network configuration of a network (e.g., the client environment 220 shown in FIG. 2) that includes a computing asset that has been the target of a cyber attack. As described above, in one embodiment, the network configuration of this network is displayed divided into network classes having different relative importance. As an example, the network configuration of this network may be divided into three classes of importance: "high," "medium," and "low." The asset that has been the target of the attack may then be highlighted in the network configuration divided by importance. This allows a user viewing the asset importance confirmation screen 1100 to easily confirm the importance of the computing asset that has been the target of the attack.

[0100] Buttons for switching to each of the asset importance confirmation screen, attack speed confirmation screen, attack progress confirmation screen, and attack priority confirmation screen are displayed in the screen switching window 1120. The user can switch to the desired confirmation screen by pressing any of the buttons.

[0101] The data log information table 1130 displays data log information acquired about a computing asset that is the target of a cyber attack. For example, as shown in Fig. 11, the data log information table 1130 may include information such as the detection time of each security event in a cyber attack, the target device, the type of data log, the attack method, and the importance of the target computing asset. The data log information table 1130 allows a user to check information about an ongoing cyber attack in real time.

[0102] 12 is a diagram showing an attack progress confirmation screen 1200 for confirming the degree of progress of a cyber attack according to an embodiment of the present disclosure. As shown in FIG. 12, the attack progress confirmation screen 1200 includes an attack method information display window 1210, a screen switching window 1120, and a data log information table 1130.

[0103] In the attack method information display window 1210, attack method information for identifying the attack method of a cyber attack is displayed. The attack method information displayed in the attack method information display window 1210 is, for example, information acquired from the above-mentioned security organization (for example, the security organization 210 shown in FIG. 2), and may be substantially similar information to the attack method table 400 shown in FIG. 4. As shown in FIG. 12, in the attack method information display window 1210, the attack method used in the currently ongoing cyber attack may be highlighted. As described above, these attack methods are one of the indicators indicating the degree of progress of the cyber attack. Therefore, in this way, a user viewing the attack progress confirmation screen 1200 can easily confirm the degree of progress of the cyber attack.

[0104] 13 is a diagram showing an attack speed confirmation screen 1300 for confirming the speed of a cyber-attack according to an embodiment of the present disclosure. As shown in FIG. 13, the attack speed confirmation screen 1300 includes a cyber-attack speed window 1310, a screen switching window 1120, and a data log information table 1130.

[0105] In the cyber attack speed window 1310, the transition of the time interval of security events in a cyber attack is displayed in a graph format. As described above, the time interval of security events in a cyber attack is one of the indicators showing the speed of the progress of the cyber attack. In one embodiment, the graph displayed in the cyber attack speed window 1310 may divide the speed of the cyber attack into three classes: "high", "medium", and "low". These classes may be divided by color. In this way, a user viewing the attack speed confirmation screen 1300 can easily confirm the speed of the cyber attack.

[0106] 14 is a diagram showing a priority confirmation screen 1400 for confirming the priority of a cyber-attack according to an embodiment of the present disclosure. As shown in FIG. 14, the priority confirmation screen 1400 includes a priority evaluation window 1410 showing a priority evaluation table, a screen switching window 1120, and a data log information table 1130.

[0107] In the priority evaluation window 1410, a priority evaluation table is displayed. This priority evaluation table is, for example, a table used to determine the priority of a cyber-attack as described above. As shown in FIG. 14, in one embodiment, the evaluation result of the cyber-attack (i.e., priority information indicating the priority) may be reflected in the priority evaluation table. This allows a user viewing the priority confirmation screen 1400 to check the priority determination result for each time-dependent parameter and non-time-dependent parameter.

[0108] According to the user interfaces shown in FIGS. 11 to 14 described above, the user can check the time-dependent parameters and non-time-dependent parameters that characterize a cyber attack in real time.

[0109] Aspects of the present invention may be implemented in any form, such as an apparatus, a method, a system, a program, etc. In one embodiment, the present invention may be implemented as a program introduced into any computing environment from a storage medium of an external device via a communication network, or via a portable storage medium. In this case, one aspect of the present invention includes a step of acquiring data log information indicating security events in a cyber attack, attack method information for identifying an attack method of the cyber attack, attack target information regarding the attack target, and network structure information indicating a network structure including the attack target as attack evaluation information for evaluating a cyber attack against an attack target that is the target of a cyber attack, a step of calculating a time interval between the security events based on the data log information, a step of determining a speed parameter indicating a progress speed of the cyber attack based on the time interval between the security events, a step of determining the attack method of the cyber attack based on the attack method information, a step of determining a progress parameter indicating a degree of progress of the cyber attack based on the determined attack method, and The cyber-attack system may further include a storage medium having stored therein a computer program for causing a computer to execute the steps of: determining a network rank in the network structure of the attack target based on attack target information relating to an enemy and network structure information indicating a network structure including the attack target; determining an asset importance parameter indicating the importance of the attack target based on the determined network rank of the attack target; a priority evaluation table that associates the progress speed of the cyber-attack, the degree of progress of the cyber-attack, and the importance of the attack target with the priority of the cyber-attack; determining the priority of the cyber-attack based on the speed parameter, the progress parameter, and the asset importance parameter; and generating and outputting priority information indicating the determined priority before the cyber-attack is completed.

[0110] Although the embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and various modifications are possible without departing from the gist of the present invention. [Explanation of symbols]

[0111] 200 Cyber ​​Security Management System 210 Security Agency 212 Server device 220 Client Environment 221, 222, 223 Client device 230 Communication Network 250 Cybersecurity Management Device 252 Information Acquisition Department 254 Parameter Judgment Unit 256 Priority judgment section 258 Storage section 260 Priority Evaluation Table

Claims

1. an information acquisition unit that acquires attack evaluation information for evaluating a cyber attack against an attack target that is a target of the cyber attack; a parameter determination unit that determines a time-dependent parameter and a non-time-dependent parameter as evaluation criteria for evaluating the cyber-attack based on the attack evaluation information; a priority determination unit that determines a priority of the cyber-attack based on the time-dependent parameter and the non-time-dependent parameter; A cybersecurity management device comprising: The information acquisition unit The attack evaluation information includes: Data log information indicating security events in the cyber attack against the target of attack; Attack method information for identifying the attack method of the cyber attack; Attack target information regarding the attack target, and network structure information indicating a network structure including the attack target; Including, The parameter determination unit Calculating a time interval for the security event based on the data log information; determining a speed parameter indicating a progress speed of the cyber-attack as the time-dependent parameter based on a time interval of the security event; determining an attack method of the cyber-attack based on the attack method information; determining a progress parameter indicating a degree of progress of the cyber-attack as the time-dependent parameter based on the determined attack method; determining a network rank in a network structure of the attack target based on attack target information related to the attack target and network structure information indicating a network structure including the attack target; determining an asset importance parameter indicating the importance of the attack target as the non-time-dependent parameter based on the determined network rank of the attack target; The cybersecurity management device includes: Further comprising a memory unit for storing a priority evaluation table that associates the progress speed of the cyber attack, the degree of progress of the cyber attack, and the importance of the target of the attack with the priority of the cyber attack; The priority determination unit determining a priority of the cyber-attack based on the speed parameter, the progress parameter, and the asset importance parameter using the priority evaluation table; Cyber ​​security management device.

2. The priority determination unit generating and outputting priority information indicating the priority of the cyber-attack before the cyber-attack is terminated; A cybersecurity management device according to claim 1 .

3. A cybersecurity management method in the cybersecurity management device according to claim 1, The information acquisition unit acquires, as attack evaluation information for evaluating a cyber-attack against an attack target that is a target of the cyber-attack, data log information indicating security events in the cyber-attack, attack method information for identifying the attack method of the cyber-attack, attack target information regarding the attack target, and network structure information indicating a network structure including the attack target; the parameter determining unit calculating a time interval of the security event based on the data log information; The parameter determination unit determines a speed parameter indicating a progress speed of the cyber-attack based on a time interval of the security event; determining an attack method of the cyber-attack based on the attack method information; a step of determining a progress parameter indicating a degree of progress of the cyber-attack based on the determined attack method by the parameter determination unit; a step of the parameter determination unit determining a network rank in the network structure of the attack target based on attack target information related to the attack target and network structure information indicating a network structure including the attack target; a step of the parameter determination unit determining an asset importance parameter indicating the importance of the attack target based on the determined network class of the attack target; a step of the priority determination unit determining the priority of the cyber-attack based on a priority evaluation table that associates the progress speed of the cyber-attack, the degree of progress of the cyber-attack, and the importance of the target of the attack with the priority of the cyber-attack, the speed parameter, the progress parameter, and the asset importance parameter; generating and outputting priority information indicating the determined priority by the priority determination unit before the cyber attack ends; A cybersecurity management method comprising:

4. 1. A cybersecurity management system, comprising: A security agency server device that provides information to combat cyber attacks; A client device that is a target of a cyber attack; A cybersecurity management device according to claim 1 for determining the priority of a cyber-attack; Including, The cybersecurity management device includes: acquiring data log information indicating security events in a cyber-attack from the client device as attack evaluation information for evaluating a cyber-attack against a target that is a target of the cyber-attack; acquiring attack method information for identifying an attack method of the cyber attack from the security agency server device; an information acquisition unit that acquires, from the client device, attack target information related to the attack target and network structure information indicating a network structure including the attack target; Calculating a time interval between the security events based on the data log information; and determining a speed parameter indicative of a progress speed of the cyber-attack based on the time interval between the security events; determining an attack method of the cyber-attack based on the attack method information, and determining a progress parameter indicating a degree of progress of the cyber-attack based on the determined attack method; a parameter determination unit that determines a network rank in the network structure of the attack target based on attack target information related to the attack target and network structure information indicating a network structure including the attack target, and determines an asset importance parameter indicating the importance of the attack target based on the determined network rank of the attack target; determining a priority of the cyber-attack based on a priority evaluation table that associates the progress speed of the cyber-attack, the degree of progress of the cyber-attack, and the importance of the target of the attack with the priority of the cyber-attack, the speed parameter, the progress parameter, and the asset importance parameter; a priority determination unit that generates priority information indicating the determined priority before the cyber attack ends and transmits the priority information to the client device; A cybersecurity management system comprising:

Images