Risk assessment device, risk assessment method, and risk assessment program

Abstract

A risk assessment device (20) comprises: a graph processing unit (23) that creates a state transition diagram for a continuous-time Markov chain, which is a data structure which includes the nodes and edges of a BAG and in which calculated transition rates are assigned to the edges instead of exploit success probabilities of the edges; and a graph analysis unit (24) that calculates the risk probability of each node, which changes with the elapsed time t since the start of an attack by an attacker, by executing Markov analysis processing on the basis of the state transition diagram created by the graph processing unit (23) and the elapsed time t.

Description

[Technical Field]

[0001] The present invention relates to a risk assessment device, a risk assessment method, and a risk assessment program. [Background technology]

[0002] Network systems are exposed to various threats of cyber attacks. For correct and efficient risk management, risk assessment is used to accurately identify system security risks and quantitatively analyze and evaluate those identified security risks. Generally, cyber attacks against network systems are carried out by sequentially exploiting multiple vulnerabilities within the system. Therefore, in risk assessment, it is essential to identify, analyze, and evaluate risks by taking into account the vulnerabilities inherent in the system and their dependencies.

[0003] Non-Patent Document 1 describes a security risk assessment method using BAG (Bayesian Attack Graph). This method uses BAG to represent the probabilistic dependencies between vulnerabilities inherent in a network system, and comprehensively describes the routes (attack procedures) that an attacker can take to attack information assets within the system. In other words, by using BAG, it is possible to mechanically and quantitatively calculate the probability of transitioning to each system state while taking into account the dependency relationships between vulnerabilities. The details of BAG are explained below.

[0004] FIG. 8 is a graph showing an example of a conventional BAG. BAG is a Bayesian network (BN) that represents the probabilistic dependencies between vulnerabilities inherent in a network system. BAG comprehensively describes the routes (attack procedures) that an attacker can take to attack information assets within the system. S0,S1,…,S 28 Each node in the BAG, such as, indicates the system state. The edges of BAG that connect each node of BAG have P0,1 ,P 0,2 ,…,P 27,28 The probability of a system state transition such as this is given, i.e., the probability of successful exploitation of the corresponding vulnerability. 0,1 The subscript of the transition source system state (for example, S0) and the transition destination system state number (for example, S1) are combined. Here, the system state refers to, for example, "a state in which administrator privileges for a specific information asset (such as a host) have been passed to an attacker," and the transition of the system state corresponds to "(successful) exploitation of a vulnerability."

[0005] For example, suppose the nodes in the following BAG are connected by edges. First node: "A remote attacker has launched an attack." Second node: "The host with IP address '196.216.0.128' running Open SSH is under attack." Third node: "Host authentication can be bypassed (Authentication bypass)" Here, let's assume that the edge from node 2 to node 3 is assigned a "70%" exploit success probability. This "exploit success probability" indicates the probability that an attacker will be able to fraudulently pass host authentication by launching a cyber attack that exploits a vulnerability inherent in Open SSH running on the host and succeeding in that attack.

[0006] In this way, the exploit success probability is a probability value assigned to each edge of the BAG entered in advance by an administrator, etc. The exploit success probability is the probability that an attacker will successfully exploit a vulnerability, and is recorded in the CPT (conditional probability table) of each node. Furthermore, the BAG nodes also include nodes that indicate situations that administrators recognize as security risks, such as "a situation in which administrative privileges for a specific information asset, such as a host that manages confidential information, are passed to an attacker." The "risk probability" is the probability that such a risk will occur, and this risk probability is a probability value calculated by the BAG analysis process, taking into account the dependencies of the BAG's exploit success probability. [Prior art documents] [Non-patent literature]

[0007] [Non-Patent Document 1] N. Poolsappasit, R. Dewri and I. Ray, “Dynamic Security Risk Management Using Bayesian Attack Graphs,” IEEE Transactions on Dependable and Secure Computing, vol. 9, no. 1, pp. 61-74, 2012. Summary of the Invention [Problem to be solved by the invention]

[0008] Because the environment surrounding network systems and the characteristics and magnitude of the risks they pose change constantly, risk assessments must be performed dynamically, quickly, and accurately. In other words, the assessment must take into account changes in risk over time. In particular, changes in the time required to launch a vulnerability attack are an important factor to consider in risk assessments. For example, it takes a certain amount of time for an attacker to achieve their goal (i.e., transition to the desired system state described in the BAG) after starting an attack on a network system, so the risk will increase as time passes.

[0009] However, conventional methods for analyzing BAGs, such as those described in Non-Patent Document 1, calculate risk probability without considering the passage of time. As a result, it is not possible to analyze how risk increases after an attack begins, which can result in assessments that lack accuracy and reality. For example, if a risk response is to be implemented within two hours from a certain point in time, the risk probability two hours into the future should be predicted and referenced when selecting and prioritizing the risks to be addressed.

[0010] Therefore, a main object of the present invention is to perform risk assessment taking into account changes in risk over time. [Means for solving the problem]

[0011] In order to solve the above problems, the risk assessment device of the present invention has the following features. The present invention is a graph composed of nodes that indicate the state of a network system that is the target of risk assessment, and edges that connect the nodes and indicate state transitions, and the graph comprises a BAG acquisition unit that acquires a BAG to which each edge is assigned an exploit success probability, which is the probability that an attacker will succeed in exploiting a vulnerability; a graph processing unit that calculates a transition speed indicating the speed at which an attacker will succeed in exploiting a vulnerability using the exploit success probability of the BAG and the limit time required to attack the vulnerability, and creates a state transition diagram of a continuous-time Markov chain that is a data structure including each node and each edge of the BAG and in which the calculated transition speed is assigned to each edge instead of the exploit success probability of each edge; a graph analysis unit that calculates a risk probability of each node that changes over time by performing a Markov analysis process based on the state transition diagram created by the graph processing unit and the elapsed time since the attacker started the attack; and and an output unit that outputs the calculated risk probability. [Effects of the Invention]

[0012] According to the present invention, risk assessment can be performed taking into account changes in risk over time. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a configuration diagram of a risk assessment device according to a first embodiment. [Figure 2] FIG. 2 is a hardware configuration diagram of the risk assessment device according to the first embodiment. [Figure 3] 10 is a flowchart showing a process in which the graph processing unit of the first embodiment generates a state transition diagram. [Figure 4] 10 is a graph for explaining a method of calculating a parameter λ in the first embodiment. [Figure 5] 4 is a graph showing an example of a state transition diagram generated by the process of FIG. 3 in the first embodiment. [Figure 6] 10 is a flowchart showing a process in which a graph processing unit according to a second embodiment generates a state transition diagram. [Figure 7] 7 is a graph showing an example of a state transition diagram generated by the process of FIG. 6 in the second embodiment. [Figure 8] 1 is a graph showing an example of a conventional BAG. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, each embodiment of the present invention will be described in detail with reference to the drawings. [Example]

[0015] FIG. 1 is a configuration diagram of a risk assessment device 20 according to the first embodiment. The main differences between the method of the risk assessment device 20 and the conventional method using BAG such as that described in Non-Patent Document 1 will be listed below. First, we will explain the difference between graphs that show the probabilistic dependencies between system states as the data structure to be analyzed. Conventionally, a BAG such as that shown in Fig. 8 has been used, and the exploit success probability has been assigned to the edges of the BAG. The risk assessment device 20 of the first embodiment handles a state transition diagram of a continuous-time Markov chain (data showing state transitions, which is explained in Fig. 5) instead of the BAG.

[0016] A continuous-time Markov chain is a type of stochastic process that has Markov properties and is defined on a continuous time axis. Here, a stochastic process is a random variable that changes depending on the passage of time. A continuous-time Markov chain enables specific Markov analysis by defining the type of stochastic dependency a Markov chain has using a state transition diagram. Furthermore, the state transition diagram and the BAG have a common configuration of nodes and edges (graph structure), but the edges of the state transition diagram are given a "transition speed" calculated by the risk assessment device 20. "Transition speed" is a parameter that indicates how quickly an attacker can successfully exploit a vulnerability (i.e., how quickly a state transition occurs), and in this specification it is referred to as "parameter λ" that is assigned to each edge of the state transition diagram.

[0017] Next, the differences in the analysis processes will be described. Conventionally, risk probabilities have been calculated by BAG analysis processing, taking into account the dependency of exploit success probabilities of BAGs. This risk probability is a parameter that does not take into account changes in risk over time. The risk assessment device 20 of the first embodiment calculates risk probabilities by executing Markov analysis processing instead of BAG analysis processing. The Markov analysis process is a process for finding the state probability of each state in the state transition diagram based on the state transition diagram and the elapsed time t given by the system administrator 10 or the like. The state probability is the probability that the system has transitioned to each state (node) at a certain time, and the state probability in a state defined as a security risk is taken as the risk probability.

[0018] Here, "elapsed time t" is the time that has elapsed since the attacker began the attack, and is a parameter designated by an administrator or the like to calculate the risk probability at the point when elapsed time t has elapsed. For example, elapsed time t can be designated as 60 minutes, 120 minutes, 180 minutes, etc. This makes it possible to observe changes in risk probability every 60 minutes. Furthermore, the "state probability" is the risk probability calculated by Markov analysis, taking into account the elapsed time t, for each state in the state transition diagram that the administrator recognizes as a security risk. This allows risk assessment to be performed taking into account changes in risk over time.

[0019] The risk assessment device 20 includes a data input unit 21 , a BAG creation unit 22 , a graph processing unit 23 , a graph analysis unit 24 , and an assessment result output unit 25 . Into the data input unit 21, parameters (such as elapsed time t and average duration T described later) required for Markov analysis processing are input by the system administrator 10 or the like. The BAG creation unit 22 creates a BAG for a network system that is the target of risk assessment, using the technology described in Non-Patent Document 1. This BAG is a graph whose components are nodes that indicate the state of the network system that is the target of risk assessment, and edges that indicate state transitions by connecting the nodes, and each edge is assigned an exploit success probability, which is the probability that an attacker will succeed in exploiting a vulnerability. Alternatively, the bag creation unit 22 may be configured as a bag acquisition unit that acquires a bag that has already been stored in a storage device.

[0020] Based on the BAG obtained from the BAG creation unit 22 and the parameters obtained from the data input unit 21, the graph processing unit 23 describes the attack paths (attack procedures) that an attacker can take as a state transition diagram of a continuous-time Markov chain. In other words, the graph processing unit 23 uses the exploit success probability of the BAG and the limit time required to attack the vulnerability to calculate a transition speed that indicates how quickly an attacker can successfully exploit the vulnerability (see FIG. 4 for details), and creates a state transition diagram of a continuous-time Markov chain, which is a data structure that includes each node and each edge of the BAG and assigns the calculated transition speed to each edge instead of the exploit success probability of each edge.

[0021] The graph analysis unit 24 performs probability calculations of Markov analysis processing based on the state transition diagram created by the graph processing unit 23 and the input elapsed time t, thereby calculating the risk probability that changes with the elapsed time t based on the exponential distribution. In other words, the graph analysis unit 24 performs Markov analysis processing based on the state transition diagram created by the graph processing unit 23 and the elapsed time t since the attacker started the attack, thereby calculating the risk probability of each node that changes with the elapsed time t. The assessment result output unit 25 outputs the risk probability calculated by the graph analysis unit 24 to the system administrator 10 or the like.

[0022] In order to make it easier to understand the explanation of the Markov analysis process executed by the graph processing unit 23, the following (Premise 1) to (Premise 3) are provided. However, the risk assessment device 20 of the first embodiment is not limited to the following premise and can be applied. (Premise 1) The time between an attacker launching an attack (attempting to exploit) a vulnerability and succeeding is assumed to be completely random and follows an exponential distribution. (Premise 2) The average time an attacker spends responding to a single vulnerability attack (a single state transition in the BAG), known as the "average duration of a unit attack, T," is assumed to be given in advance as a value for each edge or a uniform value for all edges. More specifically, the average duration, T, at which an attacker out of an unspecified number of attackers is expected to give up the attack if they have not been able to exploit the vulnerability after the average duration, T, has elapsed since they began their attack on it is assumed to be given. Since attacking skills vary among an unspecified number of attackers, the duration from when an attack on a vulnerability begins until when the attack is abandoned also varies. Therefore, we decided to use the average duration T of multiple attackers. This average duration T is a parameter input by the system administrator 10 or the like via the data input unit 21. (Premise 3) In this case, the probability value assigned to each edge of the BAG, i.e., the probability of successful exploitation of the vulnerability corresponding to each edge, is considered to be the probability that the exploit will be successful (i.e., the state transition will be successful) at the point when the average duration T has elapsed since the attacker began the vulnerability attack.

[0023] FIG. 2 is a diagram showing the hardware configuration of the risk assessment device 20. As shown in FIG. Each device of the calculation result protection system 1 is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I / F 905 , an input / output I / F 906 , and a media I / F 907 . The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (also called an application or an app for short) loaded into the RAM 902. This program can also be distributed via a communication line or recorded on a recording medium 917 such as a CD-ROM and distributed.

[0024] FIG. 3 is a flowchart showing a process in which the graph processing unit 23 of the first embodiment generates a state transition diagram. The graph processing unit 23 acquires a set ε of all edges on the BAG obtained from the BAG creating unit 22 (S11). The graph processing unit 23 executes a loop for each edge e∈ε acquired in S11 (S12 to S14). In this loop, the graph processing unit 23 calculates a parameter λ indicating an appropriate transition speed to be assigned to each edge e, and assigns the parameter λ to each edge e (S13). As a result of executing the loop of S12 to S14, the graph processing unit 23 creates a state transition diagram in which a parameter λ is assigned to each edge (S15). By the processing of Figure 3, the graph processing unit 23 describes the transition of the system state (node) on the BAG as a continuous-time Markov chain using the BAG obtained from the BAG creation unit 22 and the average duration T of a unit attack obtained from the data input unit 21 (a parameter used in S13, details are shown in Figure 4).

[0025] FIG. 4 is a graph for explaining a method for calculating the parameter λ in S13. By setting the parameter λ to the inverse of the average time from when an attacker starts an attack on a vulnerability until the attacker successfully exploits the vulnerability, it is possible to describe a Markov chain with an appropriate parameter λ set. Therefore, the graph processing unit 23 calculates such a parameter λ as follows:

[0026] First, the probability that an attacker has successfully exploited a vulnerability after a certain time t has elapsed since the attacker began attacking it is equivalent to the cumulative distribution function F(t) of the exponential distribution (Equation 1), where the value of the parameter λ is unknown. F(t)=1-e -λt …(Equation 1)

[0027] When the probability value assigned to the edge of the BAG is p, the probability that the exploit will be successful after the attacker starts the vulnerability attack (when the average duration T, which is the limit time required for the attack, has elapsed) can be considered to be p. Therefore, (Equation 2) holds. F(t)=1-e -λT =p ...(Equation 2)

[0028] By solving the equation (Equation 2), an appropriate parameter λ was obtained using (Equation 3). λ=-(ln(1-p)) / T ...(Equation 3) It should be noted that the system administrator 10 or the like may assign an arbitrary parameter λ to each edge, without relying on the calculation method described in FIG.

[0029] FIG. 5 is a graph showing an example of a state transition diagram generated by the process of FIG. The graph processing unit 23 generates the state transition diagram of Fig. 5 by executing the process of the flowchart of Fig. 3 from the BAG of Fig. 8. In this state transition diagram, the shape of the graph basically does not change from the BAG of Fig. 8, and the parameter λ is assigned to each edge.

[0030] The graph analysis unit 24 performs risk assessment by calculating the transition time between each state and the state probability (including risk probability) of each state based on the state transition diagram created by the graph processing unit 23, and notifies the assessment result output unit 25 of the execution result. Here, if a unique state transition diagram is given, the calculation method for risk assessment is also uniquely determined. An example of the calculation method procedure is given below. (Step 1) A system administrator 10 or the like arbitrarily determines the probability vector of the Markov chain in the initial state (elapsed time t=0) (hereinafter referred to as the "initial state probability vector"). If the state probability of each node in the initial state is defined as the initial state probability, the initial state probability vector is the collection of the initial state probabilities of each node. For example, in the case of the state transition diagram in Figure 5, the initial state probability vector is determined such that the initial state probability of state S0, which corresponds to the state in which a remote attacker has launched an attack, is set to 1, and the initial state probabilities of the other nodes are set to 0.

[0031] (Step 2) The graph analysis unit 24 calculates the (transient) state probability of each state at time t based on the state transition diagram and the initial state probability vector. Here, the system administrator 10 calculates the state S 15is defined as a security risk. In this case, the graph analysis unit 24 calculates the state S at the time t elapsed since the attacker started the attack on the system. 15 The state probability φ 15 Find (t).

[0032] (Step 3) The graph analysis unit 24 calculates the average time (average transition time) for each attacker to transition to each state based on the state transition diagram and the initial state probability vector. For example, when the graph analysis unit 24 calculates the average time for each attacker to transition to each state, 15 By calculating the average time it takes for the system to transition to this state, we can obtain the average time it takes for an attacker to seize user access privileges for each user terminal with IP address "10.0.0.0-127" after starting an attack on the system. Note that (Step 1) is required, but (Step 2) and (Step 3) can be performed at your discretion. For example, if you perform risk assessment using only average transition times without using state probabilities, (Step 2) does not need to be performed.

[0033] The assessment result output unit 25 provides the system administrator 10 and the like with assessment results such as various probability values ​​and average transition times received from the graph analysis unit 24. Furthermore, the assessment result output unit 25 may process the assessment result values ​​(risk probabilities) using the display processing exemplified below to make the results easier for the system administrator 10 and the like to understand before providing them. -Threshold judgment displays an alert when the risk probability exceeds the threshold and the probability value. -Sort and display the states in descending order of risk probability or in descending order of average transition time (i.e., ascending order of risk). This allows the system administrator 10 or the like to refer to the assessment results and take measures such as applying patches preferentially to vulnerabilities with higher risks. [Example]

[0034] The second embodiment will be described below. In the second embodiment, the components other than the graph processing unit 23 are the same as those in the first embodiment, including the system configuration of the risk assessment device 20. The graph processing unit 23 in the first embodiment uses the nodes and edges of the BAG as they are, and calculates and assigns only the parameter λ of the edges to create a state transition diagram of the Markov chain. On the other hand, in the second embodiment, the following problems and additional processing to solve the problems are further performed.

[0035] (Problem 1) State S obtained by the graph analysis unit 24 in the first embodiment i The state probability φ at time t i (t) means that at time t, the system is in state S i Therefore, the state S i The next state S j (state S i The probability that the state S i Taking into account the probability that the state has passed through "by time t" i The first task is to create a state transition diagram to determine the probability of transitioning to a state.

[0036] (Problem 2) The Markov analysis process by the graph analysis unit 24 is performed under the assumption that when there is a possibility of transitioning from one state to multiple other states (when there are multiple edges leading from one state), only one of them will be probabilistically selected to transition. Therefore, when there are multiple options (branches) that an attacker can take, the analysis is based on the assumption that only one of them will be selected. However, since an attacker would normally try every option while attacking, this analysis lacks realism. Therefore, the second problem is to enable an analysis that assumes that an attacker will simultaneously select multiple paths.

[0037] In the second embodiment, in order to solve (Problem 1) and (Problem 2), the graph processing unit 23 additionally executes the following (Solution 1) and (Solution 2). (Solution 1) The graph processing unit 23 calculates the target node S iThen, create a state transition diagram that can be analyzed with the target node as an absorbing state. i This allows us to calculate the probability of transitioning to (Solution 2) The graph processing unit 23 creates a state transition diagram that excludes edges other than paths that can reach the target node from a node (hereinafter referred to as "initial node") whose initial state probability is set to non-zero. This enables analysis of (Problem 2) that assumes an attacker simultaneously selects multiple paths. In other words, since all branches from the initial node are aggregated into one target node, the state probability of the target node (i.e., risk probability) can be calculated that is the same as when all branches for the target node are traced simultaneously in parallel.

[0038] FIG. 6 is a flowchart showing a process in which the graph processing unit 23 of the second embodiment generates a state transition diagram. The graph processing unit 23 sets the initial state probability of each state of the state transition diagram (sets the initial state vector) input by the data input unit 21 from the system administrator 10 or the like (S21). Note that the processing of S21 corresponds to (step 1) of the graph analysis unit 24 in the first embodiment. The graph processing unit 23 sets an arbitrary state input by the system administrator 10 or the like to the data input unit 21 as a target node (S22).

[0039] The graph processing unit 23 cuts edges extending outward from the target node to put the target node into an absorbing state (S23). An edge extending outward from the target node is an edge whose arrow starts from the target node and whose tip points to another node. The graph processing unit 23 extracts only the path from the initial node to the target node (S24). In addition, the graph processing unit 23 cuts all nodes and edges that are not included in the path extracted in S24.

[0040] The graph processing unit 23 invokes the processes (S11-S15) of FIG. 3 for the state transition diagram in which the edges have been cut in S24, thereby assigning an appropriate parameter λ to each of all edges (S25). The graph processing unit 23 outputs the result of S25 to the graph analysis unit 24 as a state transition diagram (S26).

[0041] FIG. 7 is a graph showing an example of a state transition diagram generated by the process of FIG. The state transition diagram in Fig. 7 has the same structure of nodes and links extracted from the BAG in Fig. 8 as the state transition diagram in Fig. 5. On the other hand, the state transition diagram in Fig. 7 has some nodes and edges cut from the state transition diagram in Fig. 5, as shown in S23 and S24. As a result, the state transition diagram in Fig. 7 has the following characteristics: (Feature 1) All paths converge towards the target node. (Feature 2) The target node is in an absorbing state. In other words, once a path branches off, it does not escape to another path that does not pass through the target node, but is absorbed by the target node.

[0042] For example, the initial node in Figure 7 corresponds to state S0, and the target node corresponds to state S 15 That is, the graph processing unit 23 corresponds to the state S 15 P extending from 15,17 Cut all edges such as S0 to S 15 Extract only the path up to At this time, the graph analysis unit 24 calculates the target node S 15 The state probability φ 15 (t) is the state S by time t (allowing the attacker to take multiple options simultaneously). 15 can be considered to be the probability of transitioning to

[0043] [effect] The risk assessment device 20 of the present invention is a graph composed of nodes indicating the state of a network system to be assessed for risk and edges indicating state transitions by connecting the nodes, and includes a BAG creation unit 22 that acquires a BAG to which each edge is assigned an exploit success probability, which is the probability that an attacker will succeed in exploiting a vulnerability; a graph processing unit 23 that calculates a transition speed indicating how quickly an attacker can successfully exploit a vulnerability using the exploit success probability of the BAG and the limit time required to attack the vulnerability, and creates a state transition diagram of a continuous-time Markov chain that is a data structure that includes each node and each edge of the BAG and assigns the calculated transition speed to each edge instead of the exploit success probability of each edge; a graph analysis unit 24 that calculates the risk probability of each node that changes with the elapsed time t by performing Markov analysis processing based on the state transition diagram created by the graph processing unit 23 and the elapsed time t since the attacker started the attack; and an assessment result output unit 25 that outputs the calculated risk probability.

[0044] This allows us to add the transition speed required to exploit each vulnerability for a given BAG, and describe the probabilistic dependencies between each system state as a continuous-time Markov chain. By subjecting this continuous-time Markov chain to Markov analysis, we can perform risk assessment that takes into account changes in risk over time.

[0045] In the risk assessment device 20 of the present invention, the graph analysis unit 24 further calculates an average time until transition to each state based on the state transition diagram and an initial state probability vector indicating a set of state probabilities of each node at the time when the elapsed time t is 0, The assessment result output unit 25 further outputs the calculated average time.

[0046] This allows for flexible risk response, such as dynamically changing response priorities, by knowing how the risk changes after an attack begins based on the calculated average time.

[0047] The risk assessment device 20 of the present invention is characterized in that, in the process of creating a state transition diagram, the graph processing unit 23 sets a predetermined state of the input state transition diagram as a target node, cuts edges extending outward from the target node, and cuts nodes and edges that are not included in the path from the initial node to the target node whose state probability is not 0 at the time when the elapsed time t is 0.

[0048] This aggregates all branches from the initial node into one target node, allowing the risk probability of the target node to be calculated with high accuracy, similar to when all branches for the target node are traced simultaneously in parallel. [Explanation of symbols]

[0049] 10 System Administrator 20 Risk Assessment Device 21 Data Entry Section 22 BAG creation department (BAG acquisition department) 23 Graph Processing Unit 24 Graph Analysis Section 25 Assessment result output section (output section)

Claims

1. A graph consisting of nodes that indicate the state of a network system that is the target of risk assessment, and edges that connect the nodes and indicate state transitions, and a BAG acquisition unit that acquires a BAG to which each edge is assigned an exploit success probability, which is the probability that an attacker will successfully exploit a vulnerability; a graph processing unit that calculates a transition speed indicating the speed at which an attacker can successfully exploit a vulnerability using the exploit success probability of the BAG and the limit time required to attack the vulnerability, and creates a state transition diagram of a continuous-time Markov chain that is a data structure including each node and each edge of the BAG and in which the calculated transition speed is assigned to each edge instead of the exploit success probability of each edge; a graph analysis unit that calculates a risk probability of each node that changes over time by performing a Markov analysis process based on the state transition diagram created by the graph processing unit and the elapsed time since the attacker started the attack; and and an output unit that outputs the calculated risk probability. Risk assessment device.

2. the graph analysis unit further calculates an average time until a transition to each state based on the state transition diagram and an initial state probability vector indicating a set of state probabilities of each node at the time when the elapsed time is 0; The output unit further outputs the calculated average time. The risk assessment device according to claim 1 .

3. In the step of creating the state transition diagram, the graph processing unit sets a predetermined state of the input state transition diagram as a target node, cuts edges extending outward from the target node, and cuts nodes and edges that are not included in a path from an initial node whose state probability is not 0 when the elapsed time is 0 to the target node. The risk assessment device according to claim 1 .

4. The risk assessment device includes a BAG acquisition unit, a graph processing unit, a graph analysis unit, and an output unit, The BAG acquisition unit acquires a BAG, which is a graph composed of nodes indicating the state of a network system to be subjected to risk assessment and edges indicating state transitions by connecting the nodes, and in which an exploit success probability, which is the probability that an attacker will succeed in exploiting a vulnerability, is assigned to each edge; the graph processing unit calculates a transition speed indicating the speed at which an attacker will succeed in exploiting a vulnerability, using the exploit success probability of the BAG and the limit time required to attack the vulnerability, and creates a state transition diagram of a continuous-time Markov chain, which is a data structure including each node and each edge of the BAG and in which the calculated transition speed is assigned to each edge instead of the exploit success probability of each edge; the graph analysis unit performs Markov analysis processing based on the state transition diagram created by the graph processing unit and the elapsed time since the attacker started the attack, thereby calculating a risk probability of each node that changes over the elapsed time; The output unit outputs the calculated risk probability. Risk assessment methods.

5. A risk assessment program for causing a computer to function as the risk assessment device according to any one of claims 1 to 3.

Images