Training terminal, cyber training system, log collection method and program

Abstract

This provides a log collection method that enables online log collection even when communication lines have limited bandwidth. [Solution] The training terminal includes means for determining whether the bandwidth of the communication line connecting the terminal and the device to which the log is sent is narrowband, means for controlling the amount of information in the output log, and means for sending the log to the device. When the determination means determines that the bandwidth is narrowband, the control means reduces the amount of information in the log, and the transmission means sends the log with the reduced amount of information.

Claims

1. A training terminal for cyber exercises, A means for determining whether the bandwidth of the communication line connecting the terminal and the device to which the logs are sent is narrowband or not, A means to control the amount of information in the output logs, Means for transmitting the log to the device, Equipped with, If the means for making the determination determines that the bandwidth is narrowband, The control means reduces the amount of information in the log by extracting information necessary to understand the status of the cyber exercise and omitting other information. The means for transmitting transmits the log with reduced information content. Training terminal.

2. If the aforementioned bandwidth is not narrowband, The means for transmitting transmits the log, which has not reduced the amount of information, to the device. The training terminal according to claim 1.

3. The device further comprises means for receiving instruction information from the device indicating whether or not to reduce the amount of information in the log, The control means determines whether the bandwidth is narrowband or not, or controls the amount of information in the log based on the instruction information. The training terminal according to claim 1 or claim 2.

4. The system further comprises means for changing the format of the output log, The control means controls the amount of information in the log after the format has been changed. The training terminal according to claim 1 or claim 2.

5. Means for encoding the log after controlling the amount of information, The exercise terminal according to claim 1 or claim 2, further comprising:

6. The system further comprises means for compressing the encoded log, The means for transmitting transmits the compressed log. The training terminal according to claim 5.

7. The aforementioned transmission means transmits the log to the configured destination based on the destination setting information for each log. The training terminal according to claim 1 or claim 2.

8. The training terminal according to claim 1 or claim 2, A management server comprising means for receiving the log and means for displaying the log on a display unit, During the execution of the cyber exercise, the transmission means repeatedly transmits, in accordance with the progress of the cyber exercise, a system monitoring log including monitoring the status of processes related to the cyber exercise, a cyber attack monitoring log including the execution time and type of cyber attack performed during the cyber exercise, and a cyber exercise evaluation log including the countermeasures taken against the cyber attack and the execution time of those countermeasures. In the management server, the receiving means receives the system monitoring log, the cyber attack monitoring log, and the cyber exercise evaluation log, and the display means displays the system monitoring log, the cyber attack monitoring log, and the cyber exercise evaluation log on the display unit. Cyber ​​training system.

9. A log collection method for collecting logs from a training terminal in a cyber exercise, The computer of the aforementioned training terminal determines whether the bandwidth of the communication line connecting its own terminal and the device to which the log is sent is narrowband or not. The computer of the aforementioned training terminal controls the amount of information in the output log, The computer of the exercise terminal transmits the log to the device, It has, In the step of making the determination, if the computer of the exercise terminal determines that the bandwidth is narrowband, In the control step described above, the computer of the exercise terminal extracts the information necessary to understand the status of the cyber exercise and reduces the amount of information in the log by omitting other information. In the transmission step, the computer of the exercise terminal transmits the log with reduced information content. Log collection method.

10. The computer of the training terminal for the cyber exercise, A step of determining whether the bandwidth of the communication line connecting the terminal and the device to which the logs are sent is narrowband, A step to control the amount of information in the output log, The steps include sending the log to the device, It has, If, in the above determination step, it is determined that the bandwidth is narrowband, In the control step described above, information necessary for understanding the status of the cyber exercise is extracted, and other information is omitted to reduce the amount of information in the log. The above transmission step involves the process of transmitting the log with reduced information content. A program that executes the command.

Images