Attack analysis support device, attack analysis support method, and program

Abstract

An attack analysis support device 10 comprises: an acquisition unit 11 which acquires either a predicate indicating the type of attack included in an observation that represents traces of an attack, or an observation type indicating the type of observation corresponding to the predicate; a noise condition generation unit 12 which, using selection information that is included in conversion information associated with the predicate or the observation type and that is used to select data to be converted that is included in log management information for managing logs, selects the data to be converted from the log management information, and generates noise conditions by converting the selected data to be converted, on the basis of conversion method information included in the conversion information; and a noise information generation unit 13 which, according to the noise conditions generated for the log management information, generates noise information used to determine whether or not the observation is noise.

Description

[Technical field]

[0001] The technical field relates to an attack analysis support device and an attack analysis support method that support the analysis of cyber attacks, and further to a program for implementing these. To Regarding. [Background technology]

[0002] Systems to support cyber-attack analysis have been proposed to improve the work efficiency of analysts who analyze cyber-attacks. One of these systems is a system that uses observations to logically infer attack methods and presents the logically inferred attack methods to analysts.

[0003] Observations are data that detects traces of an attack from logs obtained from the target system and converts them into a format that can be handled by logical inference. Attack methods are the sequence of events in an attack. For example, they include running a tool, searching the inside of the system, establishing communication with a C&C (Command and Control) server, and taking information outside.

[0004] Logical inference is the process of deriving the attack method from traces of an attack. For example, when a tool is executed, the log showing the execution of the tool becomes an trace. When an internal search is performed, the execution of a command on the terminal to confirm the connection becomes an trace. When communication with a C&C server is established, regular and quantitative communication from the terminal becomes an trace. When information is taken outside, the fact that a large amount of data was sent outside becomes an trace.

[0005] However, if the observation is not related to an attack, i.e., it is noise generated in response to traces of normal operation, the accuracy of logical inference decreases and the execution time of logical inference increases. Therefore, it is necessary to reduce the noise. Examples of noise include traces of OS (Operating System) updates and antivirus software.

[0006] As a related technique, Patent Document 1 discloses an information processing device that reduces the amount of log information. According to the information processing device of Patent Document 1, if the log information of a process matches the information in the whitelist (log information that has already been output), the log information is not output, and if the log information of the process does not match the information in the whitelist, the log information is output and the log information is added to the whitelist.

[0007] As a related technique, Patent Document 2 discloses a malware characteristic extraction system that effectively extracts the original behavior of malware from logs obtained by dynamically analyzing the malware. According to the malware characteristic extraction system of Patent Document 2, among the malware analysis logs obtained by executing a program related to malware, those that are not included in the regular file analysis logs obtained by executing a program related to a regular file (a file that is not malware) are extracted as black logs related to malware. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] JP 2014-170327 A [Patent Document 2] JP 2015-225512 A Summary of the Invention [Problem to be solved by the invention]

[0009] However, in the information processing device of Patent Document 1, log information is fixed in a specific format. Therefore, the information processing device of Patent Document 1 cannot generate information for reducing noise according to the type of attack.

[0010] Furthermore, the malware characteristic extraction system of Patent Document 2 regards logs that are not common to multiple pieces of malware as noise and removes them. Even in attacks using the same malware, the behavior of the malware changes depending on the target of the attack or the date and time of the attack (year, month, day, and time), so it is the behavior that is not common that is most likely to be an attack. Therefore, the malware characteristic extraction system of Patent Document 2 removes attacks as noise.

[0011] According to one aspect, there is provided an attack analysis support device, an attack analysis support method, and program The purpose is to provide. [Means for solving the problem]

[0012] In order to achieve the above object, an attack analysis support device according to one aspect comprises: an acquisition unit that acquires a predicate indicating a type of an attack included in an observation indicating an attack trace, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating unit that selects conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being included in the conversion information associated with the descriptive word or the observation type, and converts the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; a noise information generation unit that generates noise information used to determine whether the observation is noise or not in accordance with the noise condition generated for the log management information; The present invention is characterized by having the following.

[0013] In order to achieve the above object, an attack analysis support method according to one aspect includes: The computer an acquisition step of acquiring a predicate indicating a type of an attack included in an observation indicating an attack trace, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating step of selecting conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being associated with the descriptive term or the observation type, and converting the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; a noise information generating step of generating noise information used to determine whether the observation is noise or not according to the noise condition generated for the log management information; The present invention is characterized by having the following.

[0014] Furthermore, in order to achieve the above object, M is , an acquisition step of acquiring a predicate indicating a type of an attack included in an observation indicating an attack trace, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating step of selecting conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being associated with the descriptive term or the observation type, and converting the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; a noise information generating step of generating noise information used to determine whether the observation is noise or not according to the noise condition generated for the log management information; Run Ruko It is characterized by: Effect of the Invention

[0015] One aspect is that information can be generated to reduce noise depending on the type of attack. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a diagram for explaining an example of an attack analysis support apparatus according to the first embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a system including the attack analysis support device according to the first embodiment. [Diagram 3] FIG. 3 is a diagram for explaining an example of observation. [Figure 4] FIG. 4 is a diagram for explaining an example of the observation information. [Diagram 5] FIG. 5 is a diagram for explaining an example of observation management information. [Figure 6] FIG. 6 is a diagram illustrating an example of the log management information. [Figure 7] FIG. 7 is a diagram for explaining an example of the observation type information. [Figure 8] FIG. 8 is a diagram illustrating an example of the conversion information correspondence management information. [Figure 9] FIG. 9 is a diagram illustrating an example of the conversion information management information. [Figure 10] FIG. 10 is a diagram illustrating an example of the noise condition management information. [Figure 11] FIG. 11 is a diagram for explaining an example of the noise information management information. [Figure 12] FIG. 12 is a diagram for explaining an example of the operation of the attack analysis support apparatus according to the first embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of a system including an attack analysis support device according to the first modification. [Figure 14] FIG. 14 is a diagram for explaining an example of the operation of the attack analysis support device of the first modification. [Figure 15] FIG. 15 is a diagram illustrating an example of a system including an attack analysis support apparatus according to the second embodiment. [Figure 16] FIG. 16 is a diagram for explaining an example of the noise judgment information. [Figure 17] FIG. 17 is a diagram for explaining an example of the operation of the attack analysis support apparatus according to the second embodiment. [Figure 18] FIG. 18 is a diagram illustrating an example of a system including an attack analysis support apparatus according to the third embodiment. [Figure 19] FIG. 19 is a diagram illustrating an example of a computer that realizes the attack analysis support device according to the first embodiment, the first modification, and the second and third embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, an embodiment will be described with reference to the drawings. In the drawings described below, elements having the same or corresponding functions are denoted by the same reference numerals, and repeated description thereof may be omitted.

[0018] (Embodiment 1) The configuration of an attack analysis support device 10 according to the first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram for explaining an example of an attack analysis support device according to the first embodiment.

[0019] [Device configuration] 1 generates information for reducing noise according to the type of attack. As shown in FIG. 1, the attack analysis support device 10 includes an acquisition unit 11, a noise condition generation unit 12, and a noise information generation unit 13.

[0020] The acquisition unit 11 acquires a predicate indicating a type of attack included in an observation indicating a trace of an attack, or an observation type indicating a type of observation corresponding to the predicate, and a log corresponding to the predicate or the observation type.

[0021] Observations are information generated by analyzing logs. For example, if a process log is analyzed and a trace of the execution of "Mimikatz," a program that steals user authentication information, is detected, the observation that "Mimikatz" was executed is generated from the log of the corresponding process.

[0022] Also, for example, if analysis of a registry log detects traces of a suspicious program being registered in a Run key, the observation that a suspicious program has been registered in the Run key is generated from the corresponding registry log.

[0023] A predicate is information that indicates the type of attack. For example, if a program that steals authentication information is executed, the predicate will be expressed as "CredentialDumping." Also, if the attack is persisted (automatic execution: the attack is executed periodically) using the Run key in the registry, the predicate will be expressed as "PersistByRunKey."

[0024] The observation type is information that indicates the type of observation corresponding to the predicate. For example, if the predicate is "CredentialDumping", the observation type is expressed as "Process". Also, if the predicate is "PersistByRunKey", the observation type is expressed as "Persistence".

[0025] The noise condition generation unit 12 selects data to be converted from the log management information using selection information for selecting data to be converted that is included in log management information for managing logs, which is possessed by conversion information associated with a predicate or an observation type, and converts the selected data to be converted based on conversion method information included in the conversion information to generate noise conditions.

[0026] The conversion information is information used to convert conversion target data associated with a predicate or an observation type to generate a noise condition. The conversion information has, for example, selection information for selecting conversion target data from the log management information and conversion method information indicating a method for converting the selected conversion target data.

[0027] The log management information is information for managing logs that include traces of attacks. The log management information includes data to be converted.

[0028] For example, when the selection information is a "folder path", the conversion target data corresponding to the "folder path" is obtained from the log management information. The conversion target data corresponding to the "folder path" is, for example, "C:\Windows\System32\sample.exe".

[0029] Also, when the conversion information is a "registry key", conversion target data corresponding to the "registry key" is obtained from the log management information. The conversion target data corresponding to the "registry key" is, for example, "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".

[0030] The noise condition is information obtained by converting the data to be converted based on the conversion method. For example, if the data to be converted is "C:\Windows\System32\sample.exe" and the conversion method information is a conversion to make the folder path common, the data to be converted is "drive:\windows\system32\sample.exe".

[0031] Also, for example, if the data to be converted is "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" and the conversion method information is a conversion to standardize the registry key, the data to be converted is "run".

[0032] The noise information generating unit 13 generates noise information to be used for determining whether an observation is noise or not according to the noise condition generated for the log management information corresponding to the predicate or the observation type. Specifically, when the noise condition is generated from different selection information, the noise condition is connected with a logical AND to generate the noise information.

[0033] For example, for log management information corresponding to a predicate or observation type, if the noise conditions are generated as "drive:\windows\system32\sample.exe" from the folder path, "drive:\windows\system32\sample.exe -h" from the command line, and "drive:\windows\system32\cmd.exe" from the folder path of the parent process, the noise information will be "drive:\windows\system32\sample.exe" and "drive:\windows\system32\sample.exe -h" and "drive:\windows\system32\cmd.exe" because the three noise conditions are generated from different selection information.

[0034] In addition, when noise conditions are generated from the same selection information, the noise conditions are connected with a logical sum (or) to generate noise information. For example, when "run" from a registry key and "runonce" from a registry key are generated as noise conditions for log management information corresponding to a predicate or observation type, the two noise conditions are generated from the same selection information, so the noise information is "run" or "runonce".

[0035] As described above, in the embodiment, conversion information is defined for each type of attack, and noise information can be generated according to the type of attack. Furthermore, by using the noise information, noise can be reduced, thereby improving the work efficiency of analysts who analyze cyber attacks.

[0036] [System Configuration] The configuration of the attack analysis support device 10 will be described in more detail with reference to Fig. 2. Fig. 2 is a diagram for explaining an example of a system including the attack analysis support device of the first embodiment.

[0037] As shown in FIG. 2, the system 100 includes an attack analysis support device 10 and storage devices (an observation DB 21, a conversion information DB 22, and a noise information DB 23).

[0038] The attack analysis support device 10 includes an acquisition unit 11, a noise condition generation unit 12, and a noise information generation unit 13.

[0039] The attack analysis support device 10 is, for example, an information processing device such as a CPU (Central Processing Unit), a programmable device such as an FPGA (Field-Programmable Gate Array), a GPU (Graphics Processing Unit), or a circuit equipped with any one or more of them, a server computer, a personal computer, or a mobile terminal.

[0040] 2, the storage device corresponds to the observation DB 21, the conversion information DB 22, the noise information DB 23, etc. The observation DB 21, the conversion information DB 22, and the noise information DB 23 can be realized using a server computer, a database, etc.

[0041] In the following description, for ease of understanding, the observation DB 21, the conversion information DB 22, and the noise information DB 23 are used, but the information stored in the above-mentioned three DBs may be stored in one or more DBs.

[0042] The observation DB 21 is a database that manages observations and logs associated with the observations. The observation DB 21 stores observation information, observation management information, log management information, and observation type information.

[0043] Observation information is information that stores observations. Observation information will be described with reference to Fig. 3 and Fig. 4. Fig. 3 is a diagram for explaining an example of observation. Fig. 4 is a diagram for explaining an example of observation information.

[0044] The observation information is, for example, information that associates information indicating a date and time, information that identifies a machine (machine name), a predicate, and information that identifies a log (log name). For example, in the case of an observation as shown in Fig. 3, the observation information is information that associates the predicate "CredentialDumping" with the date and time "20210101T00:00:00", the machine name "host001", and the log name "LOG001", as shown in the first row of table 41 in Fig. 4.

[0045] The observation management information stores information in which a predicate that can identify the type of attack from predetermined attack traces is associated with a machine name and a log name related to the predicate among the predicates of the observation information.

[0046] Fig. 5 is a diagram for explaining an example of observation management information. In table 51 in Fig. 5 showing an example of observation management information, the predicates "CredentialDumping", "LateralMovement", "Persistence", and "PersistByRunKey" are stored. The predicate "CredentialDumping" represents the execution of a program that steals authentication information, the predicate "LateralMovement" represents the execution of lateral movement between terminals, the predicate "Persistence" represents the issuance of an alert that detects the execution of persistence, and the predicate "PersistByRunKey" represents the execution that is persisted using the Run key of the registry.

[0047] In addition, in the case of table 51 in FIG. 5, the predicate “SourcePath” and the predicate “TargetPath” shown in table 41 in FIG. 4 are traces of an attack, but since they are traces that do not allow the type of attack to be identified, they are not stored in table 51.

[0048] The log management information is information for managing logs that include traces of attacks. For each of a plurality of logs, the log management information includes information such as a log name, information indicating the date and time, a machine name, and one or more conversion target data corresponding to a predicate or observation type.

[0049] Fig. 6 is a diagram for explaining an example of log management information. Table 61 in Fig. 6 showing an example of log management information is log management information when the observation type is a process. In the example of table 61, the log name "LOG001", the date and time "20210101T00:00:00", the machine name "host001", the program name "sample.exe", and multiple pieces of conversion target data are associated with each other.

[0050] The data to be converted in table 61 is the folder path "C:\windows\system32\sample.exe", the command line "C:\windows\system32\sample.exe -h", and the folder path of the parent process "C:\windows\system32\cmd.exe".

[0051] Table 62 is log management information when the observation type is persistence. In the example of table 62, the log name "LOG004", the date and time "20210101T00:01:00", the machine name "host002", and multiple pieces of conversion target data are associated with each other.

[0052] The data to be converted in table 62 is the registry key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run", the registry value name "Evil", and the registry value data "C:\temp\evil.exe".

[0053] The observation type information is information that associates a predicate with an observation type. FIG. 7 is a diagram for explaining an example of the observation type information. In the example of table 71 in FIG. 7, as described above, the predicate "CredentialDumping" is associated with the observation type "Process", and the predicate "PersistByRunKey" is associated with the observation type "Persistence". In addition, the predicate "LateralMovement" is associated with the observation type "Logon", and the predicate "Persistence" is associated with the observation type "Alert".

[0054] The conversion information DB 22 is a database that manages different conversion information for each type of observation. The conversion information DB 22 stores conversion information correspondence management information and conversion information management information.

[0055] The conversion information correspondence management information is information that associates an observation type with conversion information. Fig. 8 is a diagram for explaining an example of the conversion information correspondence management information. In the example of table 81 in Fig. 8, the observation type "process" is associated with the conversion information names "FC001, FC002, FC003" that identify the conversion information, and the observation type "persistence" is associated with the conversion information names "FC004, FC005, FC006" that identify the conversion information.

[0056] In addition, the observation type "alert" is associated with the conversion information names "FC001, FC002, FC003, FC007, FC008" that identify the conversion information, and the observation type "logon" is associated with the conversion information names "FC001, FC002, FC003" that identify the conversion information.

[0057] The conversion information management information is information for managing the conversion information. Fig. 9 is a diagram for explaining an example of the conversion information management information. In the example of the table 91 in Fig. 9, the conversion information name, the selection information for selecting the target converted data of the log management information, and the conversion method information for standardizing the selected target converted data are associated with each other.

[0058] In addition, in the example of table 91 in Figure 9, the conversion method information is associated with setting information (character case, drive letter, version) that represents the settings used in the conversion process to convert the selected target conversion data, and information that identifies the conversion process (conversion process name).

[0059] The "Character case" of the conversion method information is information that determines whether uppercase letters contained in the selected target conversion data are converted to lowercase. "Drive letter" is information that determines whether the drive letter will be made a common drive letter when the selected target conversion data contains a drive letter. "Version" is information that determines whether the version name will be made a common version name when the selected target conversion data contains a version.

[0060] The conversion process is a process of generating noise conditions by standardizing the selected target conversion data in a predetermined procedure based on the setting information. A plurality of programs used in the conversion process are stored in a storage device such as the conversion information DB 22.

[0061] In the case of table 91 in Fig. 9, the conversion information name "FC001" in Fig. 9 is associated with the selection information "folder path" and the conversion process name "folder path conversion." In this case, the selected target conversion data is made common using the setting of the setting information and the folder path conversion to generate noise conditions.

[0062] If the setting information "Character case" is set to "True", the process of converting uppercase characters in the target conversion data to lowercase is executed when converting folder paths. If "Character case" is set to "False", the process of converting uppercase characters to lowercase is not executed.

[0063] If the setting information "Drive Letter" is set to "True", when performing folder path conversion, the process of converting the drive letter included in the target conversion data to a common drive letter is executed. If "Drive Letter" is set to "False", the process of converting the drive letter is not executed.

[0064] If the setting information "Version" is set to "True", the version name included in the target conversion data is converted to a common version name when the folder path conversion is performed. If "Version" is set to "False", the version name conversion process is not performed.

[0065] The setting information is not limited to "character case", "drive letter", and "version", and other setting information may be provided.

[0066] The noise information DB 23 is a database for managing the generated noise information, and stores noise condition management information and noise information management information.

[0067] The noise condition management information is information for managing noise conditions for determining that an observation is noise. Fig. 10 is a diagram for explaining an example of the noise condition management information. In the example of table 101 in Fig. 10, information for identifying a noise condition (noise condition name), and information in which the noise condition and the conversion information name are associated with each other are managed.

[0068] For example, table 101 in FIG. 10 shows noise conditions corresponding to noise condition names "N001" to "N003" generated based on the log management information of the log name "LOG001", and noise conditions corresponding to noise condition names "N004" to "N006" generated based on the log management information of the log name "LOG004".

[0069] The generated noise condition "drive:\windows\system32\sample.exe" is stored in association with the noise condition name "N001" and the conversion information name "FC001". The generated noise condition "drive:\windows\system32\sample.exe -h" is stored in association with the noise condition name "N002" and the conversion information name "FC002". The generated noise condition "drive:\windows\system32\cmd.exe" is stored in association with the noise condition name "N003" and the conversion information name "FC003".

[0070] The generated noise condition "run" is stored in association with the noise condition name "N004" and the conversion information name "FC004". The generated noise condition "evil" is stored in association with the noise condition name "N005" and the conversion information name "FC005". The generated noise condition "drive:\temp\evil.exe" is stored in association with the noise condition name "N006" and the conversion information name "FC006".

[0071] The noise information management information is information for managing noise information for determining whether an observation is noise or not based on a noise condition. The noise information is expressed using a noise condition name based on the noise condition (based on a procedure (rule) set in advance).

[0072] Fig. 11 is a diagram for explaining an example of noise information management information. A table 111 in Fig. 11 stores noise information ("N001 and N002 and N003", "N004 and N005 and N006") generated based on three noise conditions (noise conditions corresponding to noise condition names "N001" to "N003") generated based on the log management information of the log name "LOG001" and three noise conditions (noise conditions corresponding to noise condition names "N004" to "N006") generated based on the log management information of the log name "LOG004".

[0073] Specifically, the noise information "N001 and N002 and N003" and the noise information "N004 and N005 and N006" in table 111 in FIG. 11 are generated based on the rule that those noise conditions are connected with a logical product (and) because the noise conditions are generated from different selection information related to the log management information, as shown in table 101 in FIG. 10.

[0074] In addition, when noise conditions are generated from the same selection information related to the log management information, the noise information is generated based on the rule that the noise conditions are connected with a logical sum (or). For example, when the noise conditions corresponding to the noise condition names "N00A", "N00B", and "N00C" are all generated from the same selection information, the noise information becomes "N00A or N00B or N00C".

[0075] Furthermore, for example, if the selection information for the noise condition corresponding to the noise condition name "N00A" is different from the selection information for the noise conditions corresponding to the noise condition names "N00B" and "N00C", but the selection information for the noise conditions corresponding to the noise conditions "N00B" and "N00C" is the same, the noise information will be "N00A and (N00B or N00C)."

[0076] The attack analysis support device will now be described in detail. The acquiring unit 11 first acquires a predicate and a log name by referring to the observation management information stored in the observation DB 21. For example, the acquiring unit 11 acquires the predicate "CredentialDumping" and the log name "LOG001" by referring to the table 51 in FIG.

[0077] Next, the acquiring unit 11 uses the log name acquired from the observation management information to acquire log management information that matches the acquired log name from a plurality of pieces of log management information stored in the observation DB 21. For example, the acquiring unit 11 acquires the table 61 in Fig. 6 that has a log name that matches the acquired log name "LOG001".

[0078] Next, the acquiring unit 11 uses the predicate acquired from the observation management information to acquire an observation type corresponding to the acquired predicate from the observation type information stored in the observation DB 21. For example, the acquiring unit 11 uses the acquired predicate "CredentialDumping" to refer to table 71 in Fig. 7 and acquires an observation type "Process" corresponding to the acquired predicate.

[0079] First, the noise condition generating unit 12 uses the acquired observation type to acquire the conversion information name by referring to the conversion information correspondence management information stored in the conversion information DB 22. For example, the noise condition generating unit 12 uses the acquired observation type "process" to acquire the conversion information name "FC001, FC002, FC003" corresponding to the acquired observation type by referring to the table 81 in FIG.

[0080] Next, the noise condition generating unit 12 acquires conversion information (selection information and conversion method information) by referring to the conversion information management information stored in the conversion information DB 22 using the acquired conversion information names "FC001", "FC002", and "FC003". For example, the noise condition generating unit 12 acquires conversion information corresponding to each of the conversion information names by referring to the table 91 in FIG. 9 using the acquired conversion information names "FC001", "FC002", and "FC003".

[0081] Next, the noise condition generating unit 12 refers to the acquired log management information using the selection information of the acquired conversion information, and selects conversion target data that matches the selection information from the log management information. For example, the noise condition generating unit 12 uses the selection information "folder path", "command line", and "parent process folder path" of each of the acquired conversion information names "FC001", "FC002", and "FC003" to acquire conversion target data "C:\windows\system32\sample.exe", "C:\windows\system32\sample.exe -h", and "C:\windows\system32\cmd.exe" corresponding to the selection information from the table 61 in FIG. 6.

[0082] Next, the noise condition generating unit 12 converts the selected conversion target data based on the conversion method information of the obtained conversion information to generate noise conditions. For example, the noise condition generating unit 12 converts the obtained conversion target data "C:\windows\system32\sample.exe", "C:\windows\system32\sample.exe -h", and "C:\windows\system32\cmd.exe" based on the conversion method information of each of the obtained conversion information names "FC001", "FC002", and "FC003", and generates noise conditions "drive:\windows\system32\sample.exe", "drive:\windows\system32\sample.exe -h", and "drive:\windows\system32\cmd.exe".

[0083] Specifically, in the case of the conversion target data "C:\windows\system32\sample.exe" corresponding to the conversion information name "FC001", the folder path conversion converts uppercase letters to lowercase, standardizes the drive letter, and generates the noise condition "drive:\windows\system32\sample.exe".

[0084] Next, the noise condition generating unit 12 stores information in which the noise condition, information identifying the noise condition (noise condition name), and the conversion information name are associated with each other in the noise information DB 23. For example, the noise condition generating unit 12 stores information in which the noise condition name, the noise condition, and the conversion information name are associated with each other in the noise information DB 23, as shown in table 101 in FIG.

[0085] The noise information generator 13 generates noise information for determining whether an observation is noise or not according to the noise condition generated for the log management information, and stores the noise information in the noise information DB 23.

[0086] For example, in the case of table 101 in FIG. 10, the noise information generation unit 13 connects these noise condition names with a logical AND (and) to generate noise information "N001 and N002 and N003" because the selection information for the noise conditions corresponding to the noise condition names "N001" to "N003" corresponding to the log name "LOG001" are all different.

[0087] Next, the noise information generator 13 stores the generated noise information "N001, N002, and N003" and "N004, N005, and N006" in the noise information DB 23, as shown in a table 111 in FIG.

[0088] [Device operation] The operation of the attack analysis support device 10 in the first embodiment will be described with reference to FIG. 12. FIG. 12 is a diagram for explaining an example of the operation of the attack analysis support device in the first embodiment. In the following description, the diagram will be referred to as appropriate. In the first embodiment, the attack analysis support method is implemented by operating the attack analysis support device. Therefore, the description of the attack analysis support method in the first embodiment will be replaced with the following description of the operation of the attack analysis support device.

[0089] The acquisition unit 11 first refers to the observation management information to acquire a predicate and a log name (step A1). Next, the acquisition unit 11 uses the log name acquired from the observation management information to acquire log management information that matches the acquired log name from multiple pieces of log management information (step A2). Next, the acquisition unit 11 uses the predicate acquired from the observation management information to acquire an observation type corresponding to the acquired predicate from the observation type information (step A3).

[0090] Next, the noise condition generating unit 12 refers to the conversion information correspondence management information using the acquired observation type, and acquires the conversion information name (step A4). Next, the noise condition generating unit 12 refers to the conversion information management information using the acquired conversion information name, and acquires the conversion information (selection information and conversion method information) (step A5). Next, the noise condition generating unit 12 refers to the acquired log management information using the selection information of the acquired conversion information, and selects conversion target data that matches the selection information from the log management information (step A6).

[0091] Next, the noise condition generation unit 12 converts the selected conversion target data based on the conversion method information of the acquired conversion information to generate noise conditions (step A7), and stores in the noise information DB23 the noise condition management information generated by associating the noise conditions, information identifying the noise conditions (noise condition names), and the conversion information names.

[0092] Next, the noise information generating unit 13 generates noise information for determining whether or not the observation is noise, according to the noise condition generated for each piece of log management information (step A8), and stores the noise information in the noise information DB .

[0093] The above-mentioned processing of steps A1 to A8 is performed by selecting all or some of the predicates of the observation management information and performing the processing for each of the selected predicates.

[0094] [Effects of the First Embodiment] According to the first embodiment, conversion information is defined for each type of attack, and noise information can be generated according to the type of attack. In addition, by using the noise information, noise can be reduced, improving the work efficiency of analysts who analyze cyber attacks.

[0095] [program] The program in the first embodiment may be a program that causes a computer to execute steps A1 to A8 shown in Fig. 12. By installing and executing this program in a computer, it is possible to realize the attack analysis support device and attack analysis support method in the first embodiment. In this case, the processor of the computer functions as the acquisition unit 11, the noise condition generation unit 12, and the noise information generation unit 13 and performs the processes.

[0096] The program in the first embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the acquisition unit 11, the noise condition generation unit 12, and the noise information generation unit 13.

[0097] (Variation 1) In the first modification, the noise information generated in the first embodiment is further narrowed down, thereby making it possible to improve the accuracy of the noise information.

[0098] [System Configuration] 13 is a diagram for explaining an example of a system having an attack analysis support device of Modification 1. The system 200 has an attack analysis support device 10a and a storage device (an observation DB 21, a conversion information DB 22, and a noise information DB 23).

[0099] The attack analysis support device 10a includes an acquisition unit 11, a noise condition generation unit 12, and a noise information generation unit 13. ′ and a search unit 14. Since the acquisition unit 11 and the noise condition generation unit 12 have already been described, the description of the acquisition unit 11 and the noise condition generation unit 12 will be omitted.

[0100] The noise information generating section 13' generates provisional noise information using noise conditions in the same manner as the noise information generating section 13 operates.

[0101] The search section 14 uses preset search conditions to search for noise information that matches the search conditions from the noise information generated by the noise information generating section 13'.

[0102] Specifically, the search unit 14 may perform a search using the following search conditions (1) to (3). The search unit 14 performs a search using (1) a specific character string, (2) multiple machine names, and (3) noise information as search conditions. The search conditions are input by a user via an input device (not shown) or are set in advance.

[0103] (1) The search unit 14 searches for noise information based on a specific character string, and stores the searched noise information in the noise information DB 23. The search for the noise information based on a specific character string is performed by checking whether a character string included in the noise condition of the noise information matches the specific character string. For example, if the specific character string is "sample.exe", only noise information whose noise condition includes "sample.exe" is stored in the noise information DB 23.

[0104] By searching for noise information using the specific character strings described above, for example, by searching using the executable file name of Windows Update or the executable file name of antivirus software, only noise information generated by the operation of executable files that may cause noise can be stored in the noise information DB23.

[0105] (2) The search unit 14 searches for noise information common to a plurality of machines, and stores the searched noise information in the noise information DB 23. For example, when searching for two common machines, if there is noise information for a machine name "host001" whose noise condition is "c:\windows\system32\sample.exe" and there is also noise information for a machine name "host002" whose noise condition is "c:\windows\system32\sample.exe", the noise information common to the two machines "host001" and "host002" exists, so the above noise information is registered in the noise information DB 23.

[0106] By searching for noise information common to multiple machines, operations that are thought to be common to multiple machines, such as Windows Update and antivirus software, can be registered as noise in the noise information, so that only noise information that is more noise-like can be registered in the noise information DB23.

[0107] (3) Based on the noise information, the search unit 14 searches the provisional noise information generated by the noise information generation unit 13′ for noise information in which the same noise information exists multiple times, and stores the searched noise information in the noise information DB 23 as regular noise information.

[0108] If the same noise information exists multiple times, it is highly likely that the noise is a steadily executed operation and is therefore noise. Therefore, the noise information generated from the steadily executed operation can be registered in the noise information DB 23.

[0109] [Device operation] The operation of the attack analysis support device 10a in the first modification will be described with reference to FIG. 14. FIG. 14 is a diagram for explaining an example of the operation of the attack analysis support device in the first modification. In the following description, the diagram will be referred to as appropriate. In addition, in the first modification, the attack analysis support method is implemented by operating the attack analysis support device. Therefore, the description of the attack analysis support method in the first modification will be replaced with the following description of the operation of the attack analysis support device.

[0110] Since steps A1 to A7 in FIG. 14 have already been described, the description of steps A1 to A7 will be omitted.

[0111] Noise information generator 13 ′ generates provisional noise information for determining whether an observation is noise or not according to the noise condition generated for the log management information, and stores the information in the noise information DB 23 (step B1).

[0112] The above-mentioned steps A1 to A7 and B1 are performed by selecting all or some of the predicates of the observation management information and applying them to each of the selected predicates.

[0113] After the processes of steps A1 to A7 and B1 are completed, the search unit 14 uses preset search conditions to search for noise information matching the search conditions from the provisional noise information generated by the noise information generation unit 13 (step B2). When noise information matching the search conditions is found, the searched noise information is stored in the noise information DB 23 as regular noise information (step B3).

[0114] [Effects of Modification 1] According to the first modification, the noise information generated in the first embodiment is further narrowed down to improve the accuracy of the noise information.

[0115] [program] The program in the first modification may be any program that causes a computer to execute steps A1 to A7 and B1 to B3 shown in Fig. 14. By installing and executing this program in a computer, it is possible to realize the attack analysis support device and attack analysis support method in the first modification. In this case, the processor of the computer functions as the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', and the search unit 14, and performs processing.

[0116] The program in the first modification may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13′, and the search unit 14.

[0117] (Embodiment 2) The attack analysis support device according to the second embodiment compares observations with noise information, and deletes observations that are determined to be noise.

[0118] [System Configuration] 15 is a diagram for explaining an example of a system having an attack analysis support device of embodiment 2. The system 300 has an attack analysis support device 10b and a storage device (observation DB 21, conversion information DB 22, and noise information DB 23).

[0119] The attack analysis support device 10 b includes an acquisition unit 11 , a noise condition generation unit 12 , a noise information generation unit 13 ′, a search unit 14 , and a determination unit 15 .

[0120] 15 shows a configuration in which the attack analysis support device 10b has the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13′, the search unit 14, and the judgment unit 15, but it may have a configuration in which it has the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13′, and the judgment unit 15. Alternatively, the attack analysis support device 10b may have a configuration in which it has only the judgment unit 15.

[0121] Since the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', and the search unit 14 have already been described, the description of the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', and the search unit 14 will be omitted.

[0122] The noise information DB 23 has noise judgment information. The noise judgment information manages information in which the conversion information name is associated with judgment information (for example, a matching method, a negative value, etc.). FIG. 16 is a table for explaining an example of the noise judgment information. figure It is.

[0123] 16, the conversion information name, the matching method, and the negative value are associated with each other. The matching method of the judgment information stores information representing a perfect match or a partial match. The negative value stores information for denying the judgment result.

[0124] The determination unit 15 uses the noise information to determine whether an observation is noise or not, and if the observation is noise, deletes the observation determined to be noise from the storage device.

[0125] Specifically, first, the determination unit 15 acquires a predicate and a log name of a determination target by referring to the observation management information stored in the observation DB 21. In this example, it is assumed that the acquisition unit 11 acquires a predicate "CredentialDumping" and a log name "LOG001" as a determination target by referring to the table 51 in FIG.

[0126] Next, the determination unit 15 uses the log name acquired from the observation management information to acquire log management information that matches the acquired log name from a plurality of pieces of log management information stored in the observation DB 21. For example, the acquisition unit 11 acquires the table 61 in Fig. 6 that has a log name that matches the acquired log name "LOG001".

[0127] Next, the determination unit 15 acquires the noise information by referring to the noise information management information stored in the noise information DB 23. For example, the determination unit 15 acquires the noise information "N001 and N002 and N003" from the table 111 in FIG.

[0128] Next, the determination unit 15 uses the noise condition name of the acquired noise information to acquire the conversion information name by referring to the noise condition management information stored in the noise information DB 23. For example, the determination unit 15 uses the noise conditions "N001", "N002", and "N003" to acquire the conversion information names "FC001", "FC002", and "FC003" by referring to the table 101 in FIG.

[0129] Next, the determination unit 15 uses the obtained conversion information name to refer to the conversion information management information stored in the conversion information DB 22 and obtains the conversion information. For example, the determination unit 15 uses the conversion information names "FC001", "FC002", and "FC003" to refer to the table 91 in Fig. 9 and obtains the conversion information corresponding to the conversion information names "FC001", "FC002", and "FC003".

[0130] Next, the determination unit 15 refers to the log management information using the selection information of the obtained conversion information, and selects conversion target data corresponding to the selection information from the log management information.

[0131] For example, the judgment unit 15 refers to table 61 in FIG. 6 using the selection information "folder path," "command line," and "folder path of parent process" corresponding to the conversion information names "FC001," "FC002," and "FC003" in table 91 in FIG. 9, and selects the conversion information corresponding to "C:\windows\system32\sample.exe," "C:\windows\system32\sample.exe -h," and "C:\windows\system32\cmd.exe" corresponding to each of the selection information.

[0132] Next, the determination unit 15 converts the selected conversion target data based on the conversion method information of the obtained conversion information. For example, the determination unit 15 converts the obtained conversion target data "C:\windows\system32\sample.exe", "C:\windows\system32\sample.exe -h", and "C:\windows\system32\cmd.exe" to "drive:\windows\system32\sample.exe", "drive:\windows\system32\sample.exe -h", and "drive:\windows\system32\cmd.exe" based on the conversion method information of each of the obtained conversion information names "FC001", "FC002", and "FC003".

[0133] Next, the determination unit 15 compares the converted information with the noise conditions in the noise condition management information by using the noise determination information, and determines whether the converted information is noise or not based on the comparison result.

[0134] For example, if the converted information is "drive:\windows\system32\sample.exe", the conversion information name corresponding to the converted information is "FC001", so the judgment unit 15 obtains the noise condition "drive:\windows\system32\sample.exe" corresponding to the noise condition name "N001" associated with the conversion information name "FC001" from table 101 in Figure 10.

[0135] Then, the judgment unit 15 compares the above-mentioned converted information with the noise condition corresponding to the noise condition name "N001" using the matching method "exact match" and the negative value "False", which are the judgment information associated with the conversion information name "FC001" in Table 16 in Figure 16.

[0136] The converted information "drive:\windows\system32\sample.exe" is an exact match with the noise condition "drive:\windows\system32\sample.exe" corresponding to the noise condition name "N001", so the comparison result is "True". Also, since the negated value is "False", the comparison result remains "True". Note that if the negated value is "True", the comparison result will be "False".

[0137] In addition, the other converted information "drive:\windows\system32\sample.exe -h" and "drive:\windows\system32\cmd.exe" are also compared with the noise conditions "N002" and "N003" that correspond to the noise condition names. As a result, the comparison results for the noise condition names "N001", "N002", and "N003" are all "True".

[0138] Next, the judgment unit 15 applies the truth or falsity of the noise conditions to the noise information to judge whether the observation is noise or not. Since the acquired noise information is "N001 and N002 and N003", substituting the comparison result into the noise information results in "True and True and True", and the judgment is "True". In other words, if all the noise conditions are "True", it is judged to be noise.

[0139] In addition, when the noise information is "N00A or N00B or N00C", if any of the noise conditions is true, it is determined to be noise. In addition, in the case of "N00A and (N00B or N00C)", if N00A is true and "N00B" or "N00C" is true, it is determined to be noise.

[0140] Next, the determination unit 15 deletes the log management information from the observation DB 21 based on the result of the determination. For example, if the result of the determination is true, the table 61 in FIG. 6 is deleted from the observation DB 21. If the result of the determination is false, the log management information is not deleted from the observation DB 21.

[0141] [Device operation] The operation of the attack analysis support device 10b in the second embodiment will be described with reference to FIG. 17. FIG. 17 is a diagram for explaining an example of the operation of the attack analysis support device in the second embodiment. In the following description, the diagram will be referred to as appropriate. In the second embodiment, an attack analysis support method is implemented by operating the attack analysis support device. Therefore, the description of the attack analysis support method in the second embodiment will be replaced with the following description of the operation of the attack analysis support device.

[0142] The determination unit 15 first refers to the observation management information to acquire a predicate and a log name to be determined (step C1). Next, the determination unit 15 uses the log name acquired from the observation management information to acquire log management information that matches the acquired log name from among multiple pieces of log management information (step C2).

[0143] Next, the determination unit 15 refers to the noise information management information to sequentially acquire noise information (step C3). Next, the determination unit 15 refers to the noise condition management information using the noise condition name of the acquired noise information to acquire the conversion information name (step C4).

[0144] Next, the determination unit 15 refers to the conversion information management information using the acquired conversion information name and acquires the conversion information (step C5). Next, the determination unit 15 refers to the log management information using the selection information of the acquired conversion information and selects the conversion target data corresponding to the selection information from the log management information (step C6).

[0145] Next, the determination unit 15 converts the selected conversion target data based on the conversion method information of the obtained conversion information (step C7). Next, the determination unit 15 compares the converted information with the noise condition of the noise condition management information using the noise determination information, and determines whether the noise condition is true or false (step C8).

[0146] Next, the determination unit 15 applies the truth or falsity of the noise condition to the noise information to determine whether the observation is noise or not (step C9). Next, the determination unit 15 deletes the log management information based on the result of the determination (step C10).

[0147] Next, when the determination unit 15 has executed the processes from steps C3 to C10 for all noise information in the noise condition management information (step C11: Yes), the determination unit 15 ends the determination process. If there is noise information for which the processes from steps C3 to C10 have not been executed (step C11: No), the determination unit 15 selects the next noise information (step C12) and executes the processes from steps C3 to C10 for the selected noise information.

[0148] When all or some of the predicates of the observation management information are selected and a judgment process is performed on the selected predicates, the process of steps C1 to C12 is performed on each of the selected predicates.

[0149] [Effects of the second embodiment] According to the second embodiment, noise can be reduced by using noise information generated according to the type of attack, thereby improving the work efficiency of analysts who analyze cyber attacks.

[0150] [program] The program in the second embodiment may be a program that causes a computer to execute steps C1 to C12 shown in FIG. 17. By installing and executing this program on a computer, the embodiment 2In this case, the processor of the computer functions as the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', and the search unit 14, and performs processing. Alternatively, the processor may function as the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', and the determination unit 15. Alternatively, the processor may function as the determination unit 15.

[0151] The program in the second embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', the search unit 14, and the judgment unit 15. Alternatively, each computer may function as the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', and the judgment unit 15. Alternatively, each computer may function as the judgment unit 15.

[0152] (Embodiment 3) The attack analysis support device shown in the third embodiment is a device that further includes a function for correcting conversion information and a function for displaying information related to noise information, noise conditions, noise judgment results, etc. in addition to the attack analysis support device of the second embodiment.

[0153] [System Configuration] 18 is a diagram for explaining an example of a system having an attack analysis support device of embodiment 3. The system 400 has an attack analysis support device 10c, a storage device (observation DB 21, conversion information DB 22, noise information DB 23), and an output device 30.

[0154] The attack analysis support device 10 c includes an acquisition unit 11 , a noise condition generation unit 12 , a noise information generation unit 13 ′, a search unit 14 , a determination unit 15 , a correction unit 16 , and an output information generation unit 17 .

[0155] 18 shows a configuration in which the attack analysis support device 10c has the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13′, the search unit 14, the judgment unit 15, the correction unit 16, and the output information generation unit 17, but the attack analysis support device 10c may have a configuration in which the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13′, the judgment unit 15, the correction unit 16, and the output information generation unit 17. Alternatively, the attack analysis support device 10b may have a configuration in which the judgment unit 15, the correction unit 16, and the output information generation unit 17.

[0156] Since the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', the search unit 14, and the judgment unit 15 have already been explained, the explanation of the acquisition unit 11, the noise condition generation unit 12, the noise information generation unit 13', the search unit 14, and the judgment unit 15 will be omitted.

[0157] The correction unit 16 acquires correction information for correcting the conversion information, which is generated by the user based on the noise information, and corrects the conversion information based on the acquired correction information. Specifically, the correction unit 16 first acquires correction information from an input device (not shown). Next, the correction unit 16 corrects the conversion information of the conversion information management information based on the acquired correction information. For example, the conversion method information in table 91 in FIG. 9 and the like are corrected based on the correction information.

[0158] The output information generating unit 17 generates output information for outputting the generated noise information to an output device. Specifically, the output information generating unit 17 generates information on the noise information, noise conditions, noise determination results, the number of reduced observations, correction contents, and the like, and outputs the information to the output device 30.

[0159] The output device 30 acquires output information (to be described later) that has been converted into an outputtable format by the output information generating unit 17, and outputs generated images and sounds based on the output information. The output device 30 is, for example, an image display device using a liquid crystal, an organic EL (Electro Luminescence), or a CRT (Cathode Ray Tube). Furthermore, the image display device may also include an audio output device such as a speaker. The output device 30 may also be a printing device such as a printer.

[0160] [Effects of the third embodiment] According to the embodiment, since the conversion information generated based on the noise information can be corrected, the accuracy of the noise information can be improved. In addition, since the accuracy of the noise information can be improved, the work efficiency of analysts who analyze cyber attacks can be improved.

[0161] [Physical configuration] Here, a computer that realizes the attack analysis support device by executing the programs in the first embodiment, the first modification, the second and third embodiments will be described with reference to Fig. 19. Fig. 19 is a diagram showing an example of a computer that realizes the attack analysis support device in the first embodiment, the first modification, the second and third embodiments.

[0162] 19, the computer 190 includes a CPU (Central Processing Unit) 191, a main memory 192, a storage device 193, an input interface 194, a display controller 195, a data reader / writer 196, and a communication interface 197. These components are connected to each other via a bus 211 so as to be able to communicate data with each other. Note that the computer 190 may include a GPU or an FPGA in addition to the CPU 191 or instead of the CPU 191.

[0163] The CPU 191 loads the programs (codes) in the embodiment stored in the storage device 193 into the main memory 192 and executes them in a predetermined order to perform various calculations. The main memory 192 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). The programs in the embodiment are provided in a state stored in a computer-readable recording medium 210. The programs in the embodiment may be distributed on the Internet connected via a communication interface 197. The recording medium 210 is a non-volatile recording medium.

[0164] Specific examples of the storage device 193 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 194 mediates data transmission between the CPU 191 and input devices 198 such as a keyboard and a mouse. The display controller 195 is connected to a display device 199 and controls the display on the display device 199.

[0165] The data reader / writer 196 mediates data transmission between the CPU 191 and the recording medium 210, reads out programs from the recording medium 210, and writes processing results in the computer 190 to the recording medium 210. The communication interface 197 mediates data transmission between the CPU 191 and other computers.

[0166] Specific examples of the recording medium 210 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0167] The attack analysis support device in the embodiment can be realized not by a computer with a program installed, but by using hardware corresponding to each part. Furthermore, the attack analysis support device may be realized in part by a program and the remaining part by hardware.

[0168] [Note] The following supplementary notes are further disclosed regarding the above-described embodiments. A part or all of the above-described embodiments can be expressed by (Supplementary Note 1) to (Supplementary Note 12) described below, but are not limited to the following descriptions.

[0169] (Appendix 1) an acquisition unit that acquires a predicate indicating a type of an attack included in an observation indicating an attack trace, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating unit that selects conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being included in the conversion information associated with the descriptive word or the observation type, and converts the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; a noise information generation unit that generates noise information used to determine whether the observation is noise or not in accordance with the noise condition generated for the log management information; An attack analysis support device having the above configuration.

[0170] (Appendix 2) 2. An attack analysis support device according to claim 1, a search unit that searches the noise information generated by the noise information generating means for noise information that matches the search conditions by using search conditions that are preset for searching noise; An attack analysis support device having the above configuration.

[0171] (Appendix 3) 3. An attack analysis support device according to claim 1, a determination unit that determines whether the observation is noise using the noise information, and if the observation is noise, deletes the observation determined to be noise from the storage device. An attack analysis support device having the above configuration.

[0172] (Appendix 4) 4. An attack analysis support device according to claim 1, an output information generating unit that generates output information for outputting the generated noise information to an output device; a correction unit that acquires correction information for correcting the conversion information, the correction information being generated by a user based on the noise information, and corrects the conversion information based on the acquired correction information; An attack analysis support device having the above configuration.

[0173] (Appendix 5) an acquisition step of acquiring a predicate indicating a type of an attack included in an observation indicating an attack trace, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating step of selecting conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being associated with the descriptive term or the observation type, and converting the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; a noise information generating step of generating noise information used to determine whether the observation is noise or not according to the noise condition generated for the log management information; The attack analysis support method includes:

[0174] (Appendix 6) 6. The attack analysis support method according to claim 5, A search step of searching for noise information that matches a preset search condition from among the generated noise information, using the preset search condition for searching for noise. The attack analysis support method includes:

[0175] (Appendix 7) The attack analysis support method according to claim 5 or 6, a determining step of determining whether the observation is noise using the noise information, and deleting the observation determined to be noise from a storage device if the observation is noise; The attack analysis support method includes:

[0176] (Appendix 8) 8. An attack analysis support method according to any one of claims 5 to 7, an output information generating step of generating output information for outputting the generated noise information to an output device; a correction step of acquiring correction information for correcting the conversion information, the correction information being generated by a user based on the noise information, and correcting the conversion information based on the acquired correction information; The attack analysis support method includes:

[0177] (Appendix 9) On the computer, an acquisition step of acquiring a predicate indicating a type of an attack included in an observation indicating an attack trace, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating step of selecting conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being associated with the descriptive term or the observation type, and converting the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; a noise information generating step of generating noise information used to determine whether the observation is noise or not according to the noise condition generated for the log management information; A program that contains instructions to execute Hmm.

[0178] (Appendix 10) As described in Appendix 9 program And, The program causes the computer to A search step of searching for noise information that matches a preset search condition from among the generated noise information, using the preset search condition for searching for noise. A program that contains instructions to execute Hmm.

[0179] (Appendix 11) The method described in Appendix 9 or 10 program And, The program causes the computer to a determining step of determining whether the observation is noise using the noise information, and deleting the observation determined to be noise from a storage device if the observation is noise; A program that contains instructions to execute Hmm.

[0180] (Appendix 12) Any one of appendix 9 to 11 program And, The program causes the computer to an output information generating step of generating output information for outputting the generated noise information to an output device; a correction step of acquiring correction information for correcting the conversion information, the correction information being generated by a user based on the noise information, and correcting the conversion information based on the acquired correction information; A program that contains instructions to execute Hmm.

[0181] Although the invention has been described above with reference to the embodiments, the invention is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the invention within the scope of the invention. [Industrial Applicability]

[0182] According to the above description, it is possible to generate information for reducing noise according to the type of attack, and this is useful in fields where analysis of attacks is required. [Explanation of symbols]

[0183] 10, 10a, 10b, 10c Attack analysis support device 11 Acquisition Department 12 Noise condition generator 13, 13´ Noise information generating unit 14 Search section 15 Judgment section 16 Correction section 17 Output information generation unit 21 Observation DB 22 Conversion Information DB 23 Noise Information DB 30 Output Device 100, 200, 300, 400 Systems 190 Computer 191 CPU 192 Main memory 193 Storage device 194 Input Interface 195 Display Controller 196 Data Reader / Writer 197 Communication Interface 198 Input Devices 199 Display Device 210 Recording media 211 Bus

Claims

1. An acquisition means for acquiring a predicate indicating a type of an attack included in an observation indicating a trace of an attack, or an observation type indicating a type of the observation corresponding to the predicate; a noise condition generating means for selecting conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being associated with the descriptive word or the observation type, and converting the selected conversion target data based on conversion method information included in the conversion information to generate a noise condition; a noise information generating means for generating noise information used to determine whether the observation is noise or not, in accordance with the noise condition generated for the log management information; An attack analysis support device having the above configuration.

2. The attack analysis support device according to claim 1 , a search means for searching, using preset search conditions for searching for noise, from the noise information generated by the noise information generating means for searching for noise information that matches the search conditions; An attack analysis support device having the above configuration.

3. 3. The attack analysis support device according to claim 1, a determination means for determining whether the observation is noise using the noise information, and deleting the observation determined to be noise from the storage device if the observation is noise. An attack analysis support device having the above configuration.

4. 4. An attack analysis support device according to claim 1, an output information generating means for generating output information for outputting the generated noise information to an output device; a correction means for acquiring correction information for correcting the conversion information, the correction information being generated by a user based on the noise information, and correcting the conversion information based on the acquired correction information; An attack analysis support device having the above configuration.

5. The computer Obtain a predicate indicating a type of attack included in an observation indicating an indicator of an attack, or an observation type indicating a type of the observation corresponding to the predicate; selecting conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being associated with the descriptive term or the observation type, and converting the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; generating noise information used to determine whether the observation is noise or not in accordance with the noise condition generated for the log management information; Methods to support attack analysis.

6. The attack analysis support method according to claim 5, The computer, Using preset search conditions for searching for noise, the generated noise information is searched for noise information that matches the search conditions. Methods to support attack analysis.

7. The attack analysis support method according to claim 5 or 6, The computer, Using the noise information, it is determined whether the observation is noise or not, and if the observation is noise, the observation determined to be noise is deleted from the storage device. Methods to support attack analysis.

8. 8. An attack analysis support method according to claim 5, further comprising: The computer, generating output information for outputting the generated noise information to an output device; acquiring correction information for correcting the conversion information, the correction information being generated by a user based on the noise information, and correcting the conversion information based on the acquired correction information; Methods to support attack analysis.

9. On the computer, obtaining a predicate indicating a type of attack included in an observation indicating an attack trace, or an observation type indicating a type of the observation corresponding to the predicate; selecting conversion target data from the log management information using selection information for selecting conversion target data included in log management information for managing logs, the selection information being associated with the descriptive term or the observation type, and converting the selected conversion target data based on conversion method information included in the conversion information to generate noise conditions; generating noise information used to determine whether the observation is noise or not in accordance with the noise condition generated for the log management information; A program containing instructions.

10. The program according to claim 9, The program causes the computer to Using a preset search condition for searching for noise, the generated noise information is searched for noise information that matches the search condition. A program containing instructions.

11. The program according to claim 9 or 10, The program causes the computer to Using the noise information, it is determined whether the observation is noise or not, and if the observation is noise, the observation determined to be noise is deleted from the storage device. A program containing instructions.

12. 12. The program according to claim 9, The program causes the computer to generating output information for outputting the generated noise information to an output device; acquiring correction information for correcting the conversion information, which is generated by a user based on the noise information, and correcting the conversion information based on the acquired correction information; A program containing instructions.

Images