Analytical support method, analytical support device, and program

Abstract

This analysis assistance method is performed in an analysis assistance device (20) for providing assistance in analysis of an attack scenario in an event having occurred in a monitoring target (1), the analysis being performed on the basis of raw data concerning the event. The analysis assistance method involves: acquiring raw data concerning an event having occurred in the monitoring target (1) by communicating with the monitoring target (1) or communicating with a database for recording the raw data acquired from the monitoring target (1) (step S1); and outputting a past analysis result with respect to raw data that is similar to the acquired raw data and that was acquired in the past (step S5).

Description

Technical Field

[0004] , , , ,

[0005] , , , ,

[0001] The present disclosure relates to an analysis support method, an analysis support apparatus, and a program.

Background Art

[0002] Conventionally, an analysis support method and the like for supporting analysis regarding a monitoring target have been known. As an example of an analysis support method and the like, for example, Patent Document 1 discloses a method including a step of registering an event to be analyzed, a step of collecting raw data of the registered event, a step of analyzing the raw data to obtain position information on a network of an attack target in the registered event, a step of determining whether the event to be analyzed is valid or not based on the obtained position information, and a step of generating an exception processing message for the event to be analyzed and transmitting the message to a security management server when it is determined that the event to be analyzed is not valid.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Conventionally, when an event occurs in a monitoring target, the number of analysis times is suppressed in terms of event units by determining the necessity of analysis for each event. However, conventionally, when analyzing an event that has occurred in a monitoring target, analysis is performed for each of one or more raw data related to the event, and it is not possible to suppress the number of analysis times in terms of raw data units, and there is a problem that the number of analysis times for one or more raw data related to the event increases.

[0005] Therefore, this disclosure provides an analysis support method, etc., that can suppress an increase in the number of analyses of one or more raw data related to events that occur in the monitored area. [Means for solving the problem]

[0006] An analysis support method according to one aspect of this disclosure is an analysis support method performed in an analysis support device that supports the analysis of attack scenarios in an event based on raw data relating to an event occurring in a monitored target, the method being performed by communicating with the monitored target or by communicating with a database that records the raw data acquired from the monitored target, and outputting past analysis results for raw data similar to the acquired raw data and acquired in the past.

[0007] These comprehensive or specific embodiments may be implemented as a system, method, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or as any combination of a system, method, integrated circuit, computer program, and recording medium. Furthermore, the recording medium may be a non-temporary recording medium. [Effects of the Invention]

[0008] The analysis support methods described in this disclosure can suppress the increase in the number of analyses required for one or more raw data points related to events occurring within the monitored area.

[0009] Further advantages and effects of one aspect of this disclosure will be made apparent from the specification and drawings. Such advantages and / or effects are provided by several embodiments and features described in the specification and drawings, but not all of them are necessarily provided in order to obtain one or more identical features. [Brief explanation of the drawing]

[0010] [Figure 1]Figure 1 is a block diagram showing the functional configuration of an analysis support device, etc., according to the first embodiment. [Figure 2] Figure 2 is a flowchart showing an example of the operation of the analysis support device shown in Figure 1. [Figure 3] Figure 3 is a table showing event information acquired by the analysis support device shown in Figure 1. [Figure 4] Figure 4 is a table showing the event information stored in the analysis support device shown in Figure 1. [Figure 5] Figure 5 is a flowchart showing an example of the operation included in step S3 of Figure 2. [Figure 6] Figure 6 is a flowchart showing another example of the operation included in step S3 of Figure 2. [Figure 7] Figure 7 is a table illustrating another example of the operations included in step S3 of Figure 2. [Figure 8] Figure 8 is a flowchart showing another example of the operation of the analysis support device shown in Figure 1. [Figure 9] Figure 9 is a table showing one or more groups. [Figure 10] Figure 10 is a flowchart showing yet another example of the operation included in step S3 of Figure 2. [Figure 11] Figure 11 is a flowchart showing yet another example of the operation included in step S3 of Figure 2. [Figure 12] Figure 12 is a table showing an example of the display shown on the analysis support device in Figure 1. [Figure 13] Figure 13 is a table showing another example of the display shown on the analysis support device in Figure 1. [Figure 14] Figure 14 is a block diagram showing the functional configuration of an analysis support device, etc., according to the second embodiment. [Figure 15] Figure 15 is a flowchart showing an example of the operation of the analysis support device shown in Figure 14. [Modes for carrying out the invention]

[0011] In order to solve the above problems, an analysis support method according to an aspect of the present disclosure is an analysis support method performed in an analysis support device that supports analysis of an attack scenario in the event based on log data related to an event that occurred in a monitoring target, and obtains the log data by communicating with the monitoring target or communicating with a database that records the log data acquired from the monitoring target, and outputs a past analysis result for the log data that is similar to the acquired log data and was acquired in the past.

[0012] According to this, since a past analysis result for log data that is similar to the acquired log data and was acquired in the past can be output, it is possible to output an analysis result for log data similar to the acquired log data without performing an analysis on the acquired log data, and it is possible to suppress an increase in the number of times of analyzing one or more log data related to an event that occurred in the monitoring target.

[0013] In addition, in order to solve the above problems, an analysis support method according to an aspect of the present disclosure is an analysis support method performed in an analysis support device that supports analysis of an attack scenario in the event based on log data related to an event that occurred in a monitoring target, and obtains the log data and a determination result determined by a security information event management device based on the log data, and outputs a past analysis result for the log data and the determination result that is similar to the acquired log data and the determination result and was acquired in the past.

[0014] According to this, since a past analysis result for log data and a determination result that is similar to the acquired log data and the determination result and was acquired in the past can be output, it is possible to output an analysis result for log data and a determination result similar to the acquired log data and the determination result without performing an analysis on the acquired log data and the determination result, and it is possible to suppress an increase in the number of times of analyzing one or more log data related to an event that occurred in the monitoring target.

[0015] Also, compare the acquired load data with each of the one or more pieces of load data acquired in the past, determine whether there is load data similar to the acquired load data among the one or more pieces of load data acquired in the past, and if there is such load data, the analysis result for the load data may be output.

[0016] According to this, if there is load data similar to the acquired load data, the analysis result for the load data can be output, so the analysis result for the load data similar to the acquired load data can be output without analyzing the acquired load data, and it is possible to suppress an increase in the number of times of analyzing one or more pieces of load data related to an event that occurred in the monitoring target.

[0017] Also, the load data includes a plurality of items, compare the contents of the plurality of items included in the acquired load data with the contents of the plurality of items included in each of the one or more pieces of load data acquired in the past, and if there is load data among the one or more pieces of load data acquired in the past that includes the same plurality of items as the contents of the plurality of items included in the acquired load data, it may be determined that there is load data similar to the acquired load data among the one or more pieces of load data acquired in the past.

[0018] [[ID=1,2]]

[0019] ​Furthermore, the raw data includes multiple items, and the contents of the multiple items included in the acquired raw data are compared with the contents of the multiple items included in each of the one or more raw data acquired in the past. Points are added if the contents of the multiple items included in the acquired raw data are the same as the contents of the same items included in each of the one or more raw data acquired in the past, and points are not added or points are deducted if the contents of the multiple items included in the acquired raw data are not the same as the contents of the same items included in each of the one or more raw data acquired in the past. A score is calculated for each of the one or more raw data acquired in the past, and if there is any raw data among the one or more raw data acquired in the past whose calculated score is above a predetermined threshold, it may be determined that there is raw data among the one or more raw data acquired in the past that is similar to the acquired raw data.

[0020] According to this method, analysis results can be output for raw data from one or more previously acquired raw data sets whose calculated scores are above a predetermined threshold, thus enabling the output of more accurate analysis results.

[0021] Furthermore, the raw data includes multiple items, and one or more previously acquired raw data are divided into one or more groups according to the content of the multiple items. If there is a group among the one or more groups that has the same content as the multiple items included in the acquired raw data, the acquired raw data may be assigned to that group. If there is no group among the one or more groups that has the same content as the multiple items included in the acquired raw data, the acquired raw data may be assigned to a new group.

[0022] This makes it easy to determine whether or not similar raw data has been acquired in the past.

[0023] Furthermore, the contents of the multiple items included in the acquired raw data may be compared with the contents of the multiple items related to each of the one or more groups, and if there is a group among the one or more groups that has the same contents as the contents of the multiple items included in the acquired raw data, it may be determined that there is raw data similar to the acquired raw data among the one or more raw data acquired in the past.

[0024] According to this method, analysis results can be output for raw data belonging to groups that contain the same content as multiple items included in the acquired raw data, allowing for efficient discovery of raw data similar to the acquired raw data and outputting more accurate analysis results.

[0025] Furthermore, the contents of the multiple items included in the acquired raw data may be compared with the contents of the multiple items related to each of the one or more groups. Points may be added if the contents of the multiple items included in the acquired raw data are the same as the contents of the same items related to each of the one or more groups. Points may not be added or points may be deducted if the contents of the multiple items included in the acquired raw data are not the same as the contents of the same items related to each of the one or more groups. By doing so, a score may be calculated for each of the one or more groups. If there is a group among the one or more groups whose calculated score is above a predetermined threshold, it may be determined that there is raw data similar to the acquired raw data among the one or more raw data acquired in the past.

[0026] According to this method, analysis results can be output for raw data belonging to groups whose calculated scores are above a predetermined threshold, allowing for efficient discovery of raw data similar to the acquired raw data, and enabling the output of more accurate analysis results.

[0027] Furthermore, the acquired raw data may be compared with one or more previously acquired raw data to determine whether there is any previously acquired raw data similar to the acquired raw data. If such raw data exists, the system may determine whether it has the authority to view the analysis results for that raw data. If it has the authority, the analysis results for that raw data may be output.

[0028] According to this, analysis results for raw data can be output only to those with permission to view the analysis results for that raw data, thus preventing unauthorized individuals from viewing the analysis results.

[0029] To solve the above problems, an analysis support device according to one aspect of the present disclosure is an analysis support device that supports the analysis of attack scenarios in an event based on raw data relating to an event occurring in a monitored object, and comprises an acquisition unit that acquires the raw data by communicating with the monitored object or by communicating with a database that records the raw data acquired from the monitored object, and an output unit that outputs past analysis results for raw data similar to the acquired raw data and acquired in the past.

[0030] According to this, it produces the same effects as the analysis support method described above.

[0031] To solve the above problems, a program according to one aspect of this disclosure is a program that causes a computer to execute the above-described analysis support method.

[0032] According to this, it produces the same effects as the analysis support method described above.

[0033] The embodiments will be described in detail below with reference to the drawings.

[0034] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement and connection configurations of components, steps, and the order of steps shown in the following embodiments are examples only and are not intended to limit this disclosure. Furthermore, any components in the following embodiments that are not described in an independent claim will be described as optional components.

[0035] Furthermore, each figure is a schematic diagram and not necessarily a strictly accurate representation. Also, the same reference numeral is used for the same component in each figure.

[0036] (First Embodiment) Figure 1 is a block diagram showing the functional configuration of the analysis support device 20, etc., according to the first embodiment. The functional configuration of the analysis support device 20, etc., will be explained with reference to Figure 1.

[0037] As shown in Figure 1, SOC (Security Operation Center) 10 is a security operation center that monitors monitored target 1.

[0038] For example, monitored object 1 may be a vehicle, mobile device, building, or ship. Monitored object 1 is equipped with an IDS (Intrusion Detection System) 2, an IDS (Intrusion Detection System) 3, and an IPS (Intrusion Prevention System) 4. IDS2, IDS3, and IPS4 each detect events that occur in monitored object 1. For example, events that occur in monitored object 1 may include unauthorized intrusion into monitored object 1 and attacks on monitored object 1. For example, IDS2, IDS3, and IPS4 each monitor communication between monitored object 1 and external devices, and if they detect an event that occurred in monitored object 1, they output raw data related to that event. For example, the raw data related to that event is a log related to that event. For example, monitored object 1 sends multiple raw data related to a single event that occurred in monitored object 1 to SOC10.

[0039] SOC10 is equipped with an analysis support device 20, which performs analysis of events that occur in monitored object 1. Note that the analysis support device 20 does not necessarily have to be installed in SOC10.

[0040] The analysis support device 20 is a device that assists in the analysis of events that occur in the monitored target 1. For example, the analysis support device 20 assists in the analysis of attack scenarios for events that occur in the monitored target 1, based on raw data related to those events. Conventionally, the analysis of events that occur in the monitored target 1 has been performed, for example, by an analyst with expertise in security who examines one or more raw data related to the event one by one, determines whether there was an attack, the attack method, and vulnerabilities, integrates the results of the judgment for each raw data, and identifies the attack scenario for that event. If there is raw data similar to previously acquired raw data among the one or more raw data related to the event that occurred in the monitored target 1, the analysis support device 20 outputs the past analysis results for the previously acquired raw data. This eliminates the need to analyze all of the one or more raw data related to the event that occurred in the monitored target 1, thus suppressing an increase in the number of analyses of the one or more raw data. The analysis support device 20 comprises a matching unit 21, a storage unit 22, and a display unit 23.

[0041] The matching unit 21 is an example of an acquisition unit that acquires raw data relating to events that occurred in the monitored object 1. For example, the matching unit 21 acquires the raw data by communicating with the monitored object 1 or by communicating with a database that records the raw data acquired from the monitored object 1. In addition, for example, the matching unit 21 further acquires the determination result determined by a security information event management device (not shown) based on the raw data. The matching unit 21 may acquire only the raw data relating to events that occurred in the monitored object 1 and the determination result determined by the security information event management device based on the raw data. For example, the matching unit 21 acquires information including the raw data relating to events that occurred in the monitored object 1 and the determination result determined by the security information event management device based on the raw data. In this embodiment, this information may be referred to as event information.

[0042] For example, the raw data includes multiple items. These multiple items include items indicating the content of an event that occurred in monitored object 1, an item indicating the type of monitored object 1, an item indicating the location where the event occurred in monitored object 1, and an item indicating the type of event that occurred in monitored object 1. Also, for example, the judgment result is a judgment result indicating the content of the event that occurred in monitored object 1.

[0043] The matching unit 21 is an example of an output unit that outputs past analysis results for raw data that is similar to the acquired raw data and has been acquired in the past. For example, these past analysis results may be machine analysis results or human analysis results.

[0044] For example, one or more previously acquired event information and past analysis results for each of those one or more event information are stored in the storage unit 22. For example, the matching unit 21 reads one or more previously acquired event information from the storage unit 22 and compares the acquired event information with each of the one or more event information read. For example, the matching unit 21 determines whether there is any event information among the one or more event information read that contains raw data similar to the raw data contained in the acquired event information, and a judgment result similar to the judgment result contained in the acquired event information, and if such event information exists, it outputs the past analysis results for that event information. For example, if the content of the raw data contained in the acquired event information and the content of the raw data contained in the read event information are the same, the matching unit 21 determines that the raw data contained in the acquired event information and the raw data contained in the read event information are similar. Also, for example, if the content of the judgment result contained in the acquired event information and the content of the judgment result contained in the read event information are the same, the matching unit 21 determines that the judgment result contained in the acquired event information and the judgment result contained in the read event information are similar.

[0045] The display unit 23 displays the analysis results output by the comparison unit 21.

[0046] For example, the matching unit 21 is implemented by a processor or the like, the storage unit 22 is implemented by memory or the like, and the display unit 23 is implemented by a liquid crystal display or an organic EL display or the like.

[0047] The functional configuration of the analysis support device 20, etc., has been explained above.

[0048] Figure 2 is a flowchart illustrating an example of the operation of the analysis support device 20 shown in Figure 1. Figure 3 is a table showing event information acquired by the analysis support device 20 shown in Figure 1. Figure 4 is a table showing the event information stored in the analysis support device 20 shown in Figure 1. An example of the operation of the analysis support device 20 will be explained with reference to Figures 2 through 4.

[0049] As shown in Figure 2, first, the matching unit 21 acquires event information related to an event that occurred in the monitored target 1 (step S1). For example, an event that occurred in the monitored target 1 could be an unauthorized intrusion into the monitored target 1 or an attack on the monitored target 1. The event information also includes, for example, one raw data related to the event that occurred in the monitored target 1, and one determination result determined by the security information event management device based on that raw data. For example, the raw data related to an event that occurred in the monitored target 1 is a log related to that event. For example, when an event occurs in the monitored target 1, the monitored target 1 outputs raw data related to that event, the security information event management device makes a determination based on that raw data and outputs a determination result, and the matching unit 21 acquires event information including that raw data and the determination result. For example, by acquiring event information, the matching unit 21 acquires raw data related to the event that occurred in the monitored target 1 and the determination result determined by the security information event management device based on that raw data. Note that, for example, the matching unit 21 may acquire only the raw data from the raw data and the determination result.

[0050] For example, as shown in Figure 3, event information includes raw data and a judgment result. The raw data includes multiple items. These items include the OEM (Original Equipment Manufacture) manufacturer of monitored target 1, the model of monitored target 1, the grade of monitored target 1, the ECU of monitored target 1, the IDS / IPS monitoring method for monitored target 1, and the type of anomaly in monitored target 1. The judgment result is the judgment result determined by the security information event management device based on the raw data.

[0051] Returning to Figure 2, when the matching unit 21 acquires event information, it reads one or more previously acquired event information (step S2). As described above, for example, one or more previously acquired event information is stored in the storage unit 22, and the matching unit 21 reads one or more previously acquired event information from the storage unit 22.

[0052] For example, as shown in Figure 4, the storage unit 22 stores one or more event information, as well as past analysis results and attack determination results for each of those one or more event information. In other words, the analysis results are the results of analysis based on the event information, and the determination results are the results of determination based on the event information. For example, the matching unit 21 reads one or more event information as shown in Figure 4.

[0053] Returning to Figure 2, the matching unit 21 reads one or more previously acquired event information and compares it with the event information acquired in step S1 (step S3). For example, the matching unit 21 compares the acquired event information with each of the one or more read event information and determines whether there is any event information among the one or more read event information that contains raw data similar to the raw data contained in the acquired event information, and event information that contains a judgment result similar to the judgment result contained in the acquired event information. Alternatively, for example, the matching unit 21 may acquire only the raw data from the raw data and judgment results, and compare the acquired raw data with one or more previously acquired raw data.

[0054] For example, when the matching unit 21 reads one or more event information as shown in Figure 4, it compares it with the event information obtained sequentially starting from the event information with ID 1, and determines whether there is any event information among the one or more read event information that contains raw data similar to the raw data contained in the obtained event information, and an event information that contains a judgment result similar to the judgment result contained in the obtained event information.

[0055] The matching unit 21 compares the event information acquired in step S1 and determines whether there is any event information among the one or more read event information that contains raw data similar to the raw data included in the acquired event information (step S4). For example, the matching unit 21 may acquire only the raw data from the raw data and the determination result and determine whether there is any raw data among the one or more previously acquired raw data that is similar to the acquired raw data.

[0056] For example, if the matching unit 21 acquires event information as shown in Figure 3 and reads one or more event information as shown in Figure 4, the content of the raw data contained in the acquired event information is the same as the content of the raw data contained in the read event information for ID 1. Therefore, the matching unit 21 determines that the read event information contains raw data similar to the raw data contained in the acquired event information, and determines that among the one or more event information read, there is event information that contains raw data similar to the raw data contained in the acquired event information.

[0057] Returning to Figure 2, the matching unit 21 outputs past analysis results for the read event information if, among the one or more event information pieces read, there is event information that contains raw data similar to the raw data contained in the acquired event information (Yes in step S4). For example, the matching unit 21 may output past analysis results for event information that contains raw data similar to the raw data contained in the acquired event information and also contains a judgment result similar to the judgment result contained in that event information, that is, past analysis results for raw data and judgment results that are similar to the acquired raw data and judgment result and were acquired in the past. Alternatively, for example, the matching unit 21 may acquire only the raw data from the raw data and judgment result, and if there is raw data similar to the acquired raw data among one or more raw data pieces acquired in the past, it may output past analysis results for that raw data.

[0058] The matching unit 21 does not output the analysis results if, among the one or more event information read, there is no event information that contains raw data similar to the raw data contained in the acquired event information (No in step S4).

[0059] The above describes an example of the operation of the analysis support device 20.

[0060] Figure 5 is a flowchart illustrating an example of the operations included in step S3 of Figure 2. An example of the operations included in step S3 of Figure 2 will be explained with reference to Figures 2, 3, and 5.

[0061] As shown in Figure 5, the matching unit 21 compares the contents of multiple items included in the acquired event information with the contents of multiple items included in each of the one or more read event information. For example, the matching unit 21 may acquire only the raw data from the raw data and the judgment result, and compare the contents of multiple items included in the acquired raw data with the contents of multiple items included in each of the one or more previously acquired raw data.

[0062] First, the matching unit 21 determines whether the content of the first item among the multiple items contained in the first event information among the one or more event information read is the same as the content of the first item among the multiple items contained in the acquired event information (step S11).

[0063] For example, when the matching unit 21 acquires event information as shown in Figure 3 and reads one or more event information as shown in Figure 4, it determines whether the content of the OEM included in the read event information of ID 1 is the same as the content of the OEM included in the acquired event information.

[0064] The matching unit 21 determines whether the content of the first item among multiple items in the first event information of the one or more event information read is the same as the content of the first item among multiple items in the acquired event information (Yes in step S11), and whether the content of the second item among multiple items in the first event information of the one or more event information read is the same as the content of the second item among multiple items in the acquired event information (step S11).

[0065] Thus, if the content of the nth item among the multiple items contained in the first event information of the one or more event information that has been read is the same as the content of the nth item among the multiple items contained in the acquired event information (Yes in step S11), the matching unit 21 determines whether the content of the (n+1)th item among the multiple items contained in the first event information of the one or more event information that has been read matches the content of the (n+1)th item among the multiple items contained in the acquired event information.

[0066] If the matching unit 21 finds that the contents of multiple items in the first of the one or more event information reads are the same as the contents of multiple items in the acquired event information, it adds the first of the one or more event information reads to the matching list (step S12).

[0067] The matching unit 21 determines whether the content of the first of multiple items in the first event information of the one or more event information that has been read is the same as the content of the first of multiple items in the acquired event information (No in step S11), and whether the content of the first of multiple items in the second event information of the one or more event information that has been read is the same as the content of the first of multiple items in the acquired event information (step S11), if the content of the first of multiple items in the second event information of the one or more event information that has been read is the same as the content of the first of multiple items in the acquired event information.

[0068] The matching unit 21 compares the contents of multiple items in the acquired event information with the contents of multiple items in each of the one or more imported event information, and outputs past analysis results for the event information added to the matching list. In this way, if there is event information among the one or more imported event information that contains raw data similar to the raw data in the acquired event information, the matching unit 21 determines that there is event information among the one or more imported event information that contains raw data similar to the raw data in the acquired event information, and outputs past analysis results for that event information. For example, the matching unit 21 may acquire only the raw data from the raw data and the determination results, and if there is raw data among the one or more previously acquired raw data that contains multiple items with the same content as the contents of multiple items in the acquired raw data, it may determine that there is raw data among the one or more previously acquired raw data that is similar to the acquired raw data. The matching unit 21 may then output past analysis results for that raw data.

[0069] The above describes an example of the operations included in step S3 of Figure 2.

[0070] Figure 6 is a flowchart illustrating another example of the actions included in step S3 of Figure 2. Figure 7 is a table illustrating another example of the actions included in step S3 of Figure 2. Refer to Figures 6 and 7 to explain another example of the actions included in step S3 of Figure 2.

[0071] As shown in Figure 6, the matching unit 21 compares the contents of multiple items included in the acquired event information with the contents of multiple items included in each of the one or more imported event information. The matching unit 21 then calculates a score for each of the one or more imported event information by adding points if the contents of each of the multiple items included in the acquired event information are the same as the contents of the same items included in each of the one or more imported event information, and by not adding or deducting points if the contents of each of the multiple items included in the acquired event information are not the same as the contents of the same items included in each of the one or more imported event information.

[0072] First, the matching unit 21 initializes the score of the first event information from among one or more event information acquired in the past (step S21). For example, the matching unit 21 sets the score of the first event information from among one or more event information acquired in the past to 0.

[0073] The matching unit 21 determines whether the content of the first item among multiple items included in the first event information among one or more event information acquired in the past is the same as the content of the first item among multiple items included in the acquired event information (step S22).

[0074] The matching unit 21 adds points (step S23) if the content of the first item among multiple items included in the first event information among one or more event information acquired in the past is the same as the content of the first item among multiple items included in the acquired event information (Yes in step S22).

[0075] For example, as shown in Figure 7, the matching unit 21 adds points if the content of the first item of the multiple items included in the first event information among one or more previously acquired event information items is the same as the content of the first item of the multiple items included in the acquired event information item. For example, it adds points calculated by 1 × a weighting coefficient. For example, the weighting coefficient is set in advance.

[0076] Returning to Figure 6, the matching unit 21 determines whether to add or subtract points (step S24) if the content of the first item among multiple items included in the first event information among one or more event information acquired in the past is not the same as the content of the first item among multiple items included in the acquired event information (No in step S22).

[0077] The matching unit 21 determines whether the content of the second item among the multiple items included in the first event information of the one or more event information acquired in the past is the same as the content of the second item among the multiple items included in the acquired event information (step S22).

[0078] The matching unit 21 calculates the score of the first event information from among one or more event information acquired in the past, and then determines whether the score is equal to or greater than a predetermined threshold (step S25).

[0079] If the score is above a predetermined threshold (Yes in step S25), the matching unit 21 adds the first event information from among one or more previously acquired event information to the matching list (step S26).

[0080] If the score is not above a predetermined threshold (No in step S25), and if the first event information from one or more previously acquired event information is added to the matching list (step S26), the matching unit 21 initializes the score of the second event information from one or more previously acquired event information (step S21) and calculates the score of the second event information.

[0081] The matching unit 21 calculates a score for each of the one or more event information entries that have been read, and then outputs the past analysis results for the event information that has been added to the matching list. In this way, if there is any event information among the one or more event information entries that has a calculated score above a predetermined threshold, the matching unit 21 determines that there is an event information among the one or more event information entries that contains raw data similar to the raw data contained in the acquired event information, and outputs the past analysis results for that event information.

[0082] For example, the matching unit 21 may acquire only the raw data from the raw data and the judgment results, and compare the contents of multiple items in the acquired raw data with the contents of multiple items in each of the one or more raw data acquired in the past. The matching unit 21 may then add points if the contents of multiple items in the acquired raw data are the same as the contents of the same items in each of the one or more raw data acquired in the past, and not add or subtract points if the contents of multiple items in the acquired raw data are not the same as the contents of the same items in each of the one or more raw data acquired in the past, thereby calculating a score for each of the one or more raw data acquired in the past. If the calculated score of one or more raw data acquired in the past is above a predetermined threshold, the matching unit 21 may determine that there is raw data similar to the acquired raw data among the one or more raw data acquired in the past, and output the past analysis results for that raw data.

[0083] The above describes another example of the operation included in step S3 of Figure 2.

[0084] Figure 8 is a flowchart illustrating another example of the operation of the analysis support device 20 shown in Figure 1. Figure 9 is a table showing one or more groups. Another example of the operation of the analysis support device 20 will be described with reference to Figures 8 and 9.

[0085] As shown in Figure 9, one or more previously acquired event information entries are divided into one or more groups based on the content of multiple items. In other words, for example, one or more event information entries belonging to the same group have the same content for multiple items, while one or more event information entries belonging to different groups have different content for multiple items. The matching unit 21 assigns the acquired event information to one or more groups if there is a group among the one or more groups that has the same content for multiple items included in the acquired event information, and assigns the acquired event information to a new group if there is no group among the one or more groups that has the same content for multiple items included in the acquired event information.

[0086] As shown in Figure 8, first, the matching unit 21 acquires event information (step S31) and reads the database (step S32). For example, as shown in Figure 9, the database is a database containing one or more event information entries that are divided into one or more groups according to the content of multiple items.

[0087] When the matching unit 21 reads the database, it compares the acquired event information with each of the one or more groups contained in the read database (step S33).

[0088] The matching unit 21 determines whether there is a group among the one or more groups stored in the database that has the same content as the content of multiple items included in the acquired event information (step S34).

[0089] The matching unit 21, if there is a group among the one or more groups stored in the database that has the same content as multiple items included in the acquired event information (Yes in step S34), adds the acquired event information to that group to make it belong to that group (step S35).

[0090] If the matching unit 21 finds that there is no group among the one or more groups stored in the database that has the same content as the content of multiple items included in the acquired event information (No in step S34), it adds the acquired event information to a new group to make it belong to that group (step S36).

[0091] For example, among the one or more raw data sets acquired in the past and the one or more judgment results determined in the past based on those one or more raw data sets, only the one or more raw data sets acquired in the past may be divided into one or more groups for each of the contents of multiple items. The matching unit 21 may then assign the acquired raw data to one or more groups if there is a group among the one or more groups that has the same contents as the multiple items contained in the acquired raw data, or assign the acquired raw data to a new group if there is no group among the one or more groups that has the same contents as the multiple items contained in the acquired raw data.

[0092] The above describes another example of the operation of the analysis support device 20.

[0093] Figure 10 is a flowchart illustrating yet another example of the operations included in step S3 of Figure 2. Refer to Figure 10 to illustrate yet another example of the operations included in step S3 of Figure 2.

[0094] As shown in Figure 10, the matching unit 21 compares the contents of multiple items included in the acquired event information with the contents of multiple items related to each of one or more groups. Alternatively, for example, the matching unit 21 may acquire only the raw data from the raw data and the judgment result, and then compare the contents of multiple items included in the acquired raw data with the contents of multiple items related to each of one or more groups.

[0095] First, the matching unit 21 determines whether the content of the first item among multiple items relating to the first of one or more groups is the same as the content of the first item among multiple items included in the acquired event information (step S61).

[0096] For example, when the matching unit 21 acquires event information as shown in Figure 3 and reads one or more groups as shown in Figure 9, it determines whether the content of the OEM related to the read group 1 is the same as the content of the OEM included in the acquired event information.

[0097] The matching unit 21 determines whether the content of the first item among multiple items included in the first group of one or more groups is the same as the content of the first item among multiple items included in the acquired event information (Yes in step S61), and whether the content of the second item among multiple items included in the first group of one or more groups is the same as the content of the second item among multiple items included in the acquired event information (step S61).

[0098] Thus, if the content of the nth item among multiple items included in the first group of one or more groups is the same as the content of the nth item among multiple items included in the acquired event information (Yes in step S61), the matching unit 21 determines whether the content of the (n+1)th item among multiple items included in the first group of one or more groups matches the content of the (n+1)th item among multiple items included in the acquired event information.

[0099] If the matching unit 21 finds that the contents of multiple items in the first of the one or more groups are the same as the contents of multiple items in the acquired event information, it adds the first of the one or more read event information to the matching list (step S62).

[0100] The matching unit 21 determines whether the content of the first item among multiple items included in the first group of one or more groups is the same as the content of the first item among multiple items included in the acquired event information (No in step S61), and whether the first group among one or more groups is added to the matching list (step S62), or whether the content of the first item among multiple items included in the second group of one or more groups is the same as the content of the first item among multiple items included in the acquired event information (step S61).

[0101] The matching unit 21 compares the contents of multiple items included in the acquired event information with the contents of multiple items included in one or more groups, and outputs past analysis results for the event information added to the matching list. In this way, if there is a group among one or more groups whose contents match the contents of multiple items included in the acquired event information, the matching unit 21 determines that there is event information among one or more groups that contains raw data similar to the raw data included in the acquired event information, and outputs past analysis results for that event information. For example, the matching unit 21 may acquire only the raw data from the raw data and the determination results, and compare the contents of multiple items included in the acquired raw data with the contents of multiple items related to one or more groups. Then, if there is a group among one or more groups whose contents are identical to the contents of multiple items included in the acquired raw data, the matching unit 21 may determine that there is raw data among one or more previously acquired raw data that is similar to the acquired raw data, and output past analysis results for that raw data.

[0102] The above describes yet another example of the operation included in step S3 of Figure 2.

[0103] Figure 11 is a flowchart illustrating yet another example of the operations included in step S3 of Figure 2. Referring to Figure 11, yet another example of the operations included in step S3 of Figure 2 will be explained.

[0104] As shown in Figure 11, the matching unit 21 compares the contents of multiple items included in the acquired event information with the contents of multiple items related to one or more groups. The matching unit 21 then calculates the score for one or more groups by adding points if the contents of each of the multiple items included in the acquired event information are the same as the contents of the same items related to one or more groups, and by not adding or deducting points if the contents of each of the multiple items included in the acquired event information are not the same as the contents of the same items related to one or more groups.

[0105] First, the matching unit 21 initializes the score of the first group out of one or more groups (step S41). For example, the matching unit 21 sets the score of the first group out of one or more groups to 0.

[0106] The matching unit 21 determines whether the content of the first item among multiple items relating to the first of one or more groups is the same as the content of the first item among multiple items included in the acquired event information (step S42).

[0107] The matching unit 21 adds points (step S43) if the content of the first item among multiple items related to the first of one or more groups matches the content of the first item among multiple items included in the acquired event information (Yes in step S42).

[0108] For example, as shown in Figure 9, the matching unit 21 adds points if the content of the OEM, which is the first item among multiple items related to the first of one or more groups, is the same as the content of the OEM, which is the first item among multiple items included in the acquired event information. For example, it adds points calculated by 1 × a weighting coefficient. For example, the weighting coefficient is set in advance.

[0109] Returning to Figure 11, the matching unit 21 determines whether to add or subtract points (step S44) if the content of the first item among multiple items related to the first group of one or more groups does not match the content of the first item among multiple items included in the acquired event information (No in step S42).

[0110] The matching unit 21 determines whether the content of the second item among the multiple items related to the first group of one or more groups matches the content of the second item among the multiple items included in the acquired event information, if points have been added, not added, or deducted for the first item among the multiple items related to the first group of one or more groups (step S42).

[0111] The matching unit 21 calculates a score for the first of one or more groups and then determines whether the score is equal to or greater than a predetermined threshold (step S45).

[0112] If the score is above a predetermined threshold (Yes in step S45), the matching unit 21 adds the first of the one or more groups to the matching list (step S46).

[0113] If the score is not equal to or greater than a predetermined threshold (No in step S45), and if the first group out of one or more groups is added to the matching list (step S46), the matching unit 21 initializes the score of the second group out of one or more groups (step S41) and calculates the score of the second group.

[0114] The matching unit 21 calculates a score for each of one or more groups and outputs past analysis results for the groups added to the matching list. In this way, if there is a group among one or more groups whose calculated score is above a predetermined threshold, the matching unit 21 determines that the raw data contained in the acquired event information is similar to the raw data contained in the event information belonging to that group, and determines that there is an event information among one or more previously acquired event information that contains raw data similar to the raw data contained in the acquired event information, and outputs past analysis results for that event information.

[0115] For example, the matching unit 21 may acquire only the raw data from the raw data and the judgment results, and compare the contents of multiple items included in the acquired raw data with the contents of multiple items related to each of one or more groups. The matching unit 21 may then add points if the contents of each of the multiple items included in the acquired raw data are the same as the contents of the same items related to each of one or more groups, and not add points or deduct points if the contents of each of the multiple items included in the acquired raw data are not the same as the contents of the same items related to each of one or more groups, thereby calculating the score for each of one or more groups. If there is a group among one or more groups whose calculated score is above a predetermined threshold, the matching unit 21 may determine that there is raw data similar to the acquired raw data among one or more raw data acquired in the past, and output the past analysis results for that raw data.

[0116] The above describes yet another example of the operation included in step S3 of Figure 2.

[0117] Figure 12 is a table showing an example of the display shown on the analysis support device 20 in Figure 1. An example of the display shown on the analysis support device 20 will be explained with reference to Figure 12.

[0118] As shown in Figure 12, for example, the display unit 23 displays one or more previously acquired event information in descending order of score. In other words, for example, the display unit 23 prioritizes displaying past analysis results for event information with a high similarity to the acquired event information.

[0119] The above describes an example of the display shown on the analysis support device 20.

[0120] Figure 13 is a table showing another example of the display shown on the analysis support device 20 in Figure 1. Referring to Figure 13, another example of the display shown on the analysis support device 20 will be explained.

[0121] As shown in Figure 13, for example, the display unit 23 displays one or more event information with similar content or one or more event information with similar analysis results from among multiple event information acquired in the past.

[0122] The above describes another example of the display shown on the analysis support device 20.

[0123] As described above, the analysis support method according to the first embodiment can suppress an increase in the number of analyses of one or more raw data related to an event that occurred in the monitored object 1, suppress an increase in the operating time of the equipment used for analyzing the event, and suppress an increase in the amount of electricity consumed for the operation of the equipment.

[0124] The analysis support method according to the first embodiment is an analysis support method performed by an analysis support device 20 that supports the analysis of attack scenarios in an event based on raw data relating to an event that occurred in a monitored target 1, and acquires the raw data by communicating with the monitored target 1 or by communicating with a database that records the raw data acquired from the monitored target 1 (step S1), and outputs past analysis results for raw data similar to the acquired raw data that was acquired in the past (step S5).

[0125] According to this, it is possible to output past analysis results for raw data that is similar to the acquired raw data and has been acquired in the past. Therefore, it is possible to output past analysis results for raw data similar to the acquired raw data without performing analysis on the raw data itself, and it is possible to suppress an increase in the number of analyses of one or more raw data related to events that occurred in monitored target 1.

[0126] Furthermore, the analysis support method according to the first embodiment is an analysis support method performed by an analysis support device 20 that supports the analysis of attack scenarios in an event based on raw data relating to an event that occurred in the monitored target 1, and acquires the raw data and the determination result determined by the security information event management device based on the raw data, and outputs past analysis results for raw data and determination results that are similar to the acquired raw data and determination result and have been acquired in the past.

[0127] According to this, it is possible to output past analysis results for raw data and judgment results that are similar to the acquired raw data and judgment results and that were acquired in the past. Therefore, it is possible to output analysis results for raw data and judgment results similar to the acquired raw data and judgment results without performing analysis on the raw data and judgment results themselves, thereby suppressing an increase in the number of analyses of one or more raw data related to events that occurred in monitored target 1.

[0128] Furthermore, in the analysis support method according to the first embodiment, the acquired raw data is compared with one or more previously acquired raw data (step S3), it is determined whether or not there is any raw data similar to the acquired raw data among the one or more previously acquired raw data (step S4), and if such raw data exists, the analysis results for that raw data are output (step S5).

[0129] According to this, if there is raw data similar to the acquired raw data, the analysis results for that raw data can be output. This means that the analysis results for raw data similar to the acquired raw data can be output without performing analysis on the acquired raw data, thus suppressing an increase in the number of analyses of multiple raw data related to events that occurred in monitored target 1.

[0130] Furthermore, in the analysis support method according to the first embodiment, the raw data includes multiple items, and the contents of the multiple items included in the acquired raw data are compared with the contents of the multiple items included in one or more previously acquired raw data (step S11). If there is raw data among one or more previously acquired raw data that includes multiple items with the same contents as the multiple items included in the acquired raw data, it is determined that there is raw data among one or more previously acquired event information that is similar to the acquired raw data (Yes in step S4).

[0131] According to this method, analysis results can be output for raw data that contains multiple items with the same content as multiple items in the acquired raw data, from one or more raw data sets acquired in the past, thus enabling the output of more accurate analysis results.

[0132] Furthermore, in the analysis support method according to the first embodiment, the raw data includes multiple items, and the contents of the multiple items included in the acquired raw data are compared with the contents of the multiple items included in each of the one or more raw data acquired in the past (step S22). Points are added if the contents of the multiple items included in the acquired raw data are the same as the contents of the same items included in each of the one or more raw data acquired in the past (step S23). Points are not added or deducted if the contents of the multiple items included in the acquired raw data are not the same as the contents of the same items included in each of the one or more raw data acquired in the past (step S24). By doing so, a score is calculated for each of the one or more raw data acquired in the past. If there is any raw data among the one or more raw data acquired in the past whose calculated score is above a predetermined threshold (Yes in step S25), it is determined that there is raw data among the one or more raw data acquired in the past that is similar to the acquired raw data (Yes in step S4).

[0133] According to this method, analysis results can be output for raw data from one or more previously acquired raw data sets whose calculated scores are above a predetermined threshold, thus enabling the output of more accurate analysis results.

[0134] Furthermore, in the analysis support method according to the first embodiment, the raw data includes multiple items, and one or more raw data acquired in the past are divided into one or more groups according to the content of the multiple items. If there is a group among the one or more groups that has the same content as the multiple items included in the acquired raw data, the acquired raw data is assigned to that group (step S35). If there is no group among the one or more groups that has the same content as the multiple items included in the acquired raw data, the acquired raw data is assigned to a new group (step S36).

[0135] This makes it easy to determine whether or not similar raw data has been acquired in the past.

[0136] Furthermore, the system compares the content of multiple items included in the acquired raw data with the content of multiple items related to one or more groups. If there is a group among the one or more groups whose content is identical to the content of multiple items included in the acquired raw data, it determines that there is similar raw data among the one or more previously acquired raw data sets.

[0137] According to this method, analysis results can be output for raw data belonging to groups that contain the same content as multiple items included in the acquired raw data, allowing for efficient discovery of raw data similar to the acquired raw data and outputting more accurate analysis results.

[0138] Furthermore, in the analysis support method according to the first embodiment, the contents of multiple items included in the acquired raw data are compared with the contents of multiple items related to each of one or more groups (step S42), points are added if the contents of each of the multiple items included in the acquired raw data are the same as the contents of the same items among the multiple items related to each of one or more groups (step S43), and points are not added or points are deducted if the contents of each of the multiple items included in the acquired raw data are not the same as the contents of the same items among the multiple items related to each of one or more groups (step S44), thereby calculating the score for each of one or more groups, and if there is a group among one or more whose calculated score is above a predetermined threshold (Yes in step S45), it is determined that there is raw data similar to the acquired raw data among one or more raw data acquired in the past (Yes in step S4).

[0139] According to this method, analysis results can be output for raw data belonging to groups whose calculated scores are above a predetermined threshold, allowing for efficient discovery of raw data similar to the acquired raw data, and enabling the output of more accurate analysis results.

[0140] The analysis support device 20 according to the first embodiment is an analysis support device that communicates with a monitored object 1 and supports the analysis of an attack scenario in an event based on raw data relating to an event that occurred in the monitored object 1, and comprises an acquisition unit (matching unit 21) that acquires the raw data and an output unit (matching unit 21) that outputs analysis results for raw data similar to the acquired raw data and acquired in the past.

[0141] According to this, it produces the same effects as the analysis support method described above.

[0142] (Second Embodiment) Figure 14 is a block diagram showing the functional configuration of the analysis support device 20a, etc., according to the second embodiment. The functional configuration of the analysis support device 20a, etc., will be described with reference to Figure 14.

[0143] As shown in Figure 14, SOC10a differs from SOC10 mainly in that it is equipped with an analysis support device 20a instead of the analysis support device 20. The analysis support device 20a differs from the analysis support device 20 mainly in that it is further equipped with an authorization determination unit 24.

[0144] The authorization determination unit 24 determines whether the user has permission to view past analysis results for event information if, among the one or more event information read, there is event information that contains raw data similar to the raw data contained in the acquired event information, and event information that contains judgment results similar to the judgment results contained in the acquired event information. Alternatively, for example, the matching unit 21 acquires only the raw data from the raw data and judgment results, and the authorization determination unit 24 determines whether the user has permission to view past analysis results for raw data if there is raw data similar to the acquired raw data among one or more raw data acquired in the past. For example, the analysis support device 20a accepts login information input from a user to use the analysis support device 20a, and the authorization determination unit 24 refers to the input login information and determines whether the user has permission to view past analysis results for the event information or the raw data. For example, login information for which viewing is permitted is stored in advance. The permission determination unit 24 determines that if the entered login information matches the pre-stored login information, the user has permission to view the event information or past analysis results for the raw data. If the entered login information does not match the pre-stored login information, the user does not have permission to view the event information or past analysis results for the raw data.

[0145] The functional configuration of the analysis support device 20a, etc., has been explained above.

[0146] Figure 15 is a flowchart illustrating an example of the operation of the analysis support device 20a shown in Figure 14. Referring to Figure 15, an example of the operation of the analysis support device 20a will be explained. Note that the following explanation will focus on the differences from the example of operation shown in Figure 2.

[0147] As shown in Figure 14, the authorization determination unit 24 determines whether or not it has the authority to view past analysis results for the loaded event information if the loaded event information contains raw data similar to the raw data contained in the acquired event information (Yes in step S4) (step S51).

[0148] If the matching unit 21 has permission to view past analysis results for the loaded event information (Yes in step S51), it outputs the past analysis results for the event information (step S5).

[0149] If the matching unit 21 does not have permission to view past analysis results for the loaded event information (No in step S51), it will not output past analysis results for the event information.

[0150] For example, the matching unit 21 may acquire only the raw data from the raw data and the judgment results, compare the acquired raw data with one or more previously acquired raw data, and determine whether there is any raw data similar to the acquired raw data among the one or more previously acquired raw data. Then, if such raw data exists, the authorization determination unit 24 may determine whether there is authorization to view the analysis results for that raw data, and if such authorization exists, the matching unit 21 may output the past analysis results for that raw data.

[0151] The above describes an example of the operation of the analysis support device 20a.

[0152] In the analysis support method according to the second embodiment, the acquired raw data is compared with one or more previously acquired raw data (step S3), it is determined whether there is any raw data similar to the acquired raw data among the one or more previously acquired raw data (step S4), if such raw data exists (Yes in step S4), it is determined whether there is permission to view past analysis results for such raw data (step S51), and if such permission exists, the analysis results for such raw data are output (step S5).

[0153] According to this, analysis results for raw data can be output only to those with permission to view the analysis results for that raw data, thus preventing unauthorized individuals from viewing the analysis results.

[0154] Note that the necessary permissions and types for viewing may be set individually for each of the one or more event information records that have been retrieved in the past.

[0155] (Other embodiments, etc.) The analysis support methods and other aspects of this disclosure have been described above based on the embodiments described above, but this disclosure is not limited to those embodiments. Various modifications to the embodiments that a person skilled in the art could conceive of may also be included in this disclosure, as long as they do not deviate from the spirit of this disclosure.

[0156] For example, the display unit 23 may prioritize displaying past analysis results that have received many "likes" from people.

[0157] Alternatively, for example, the threshold could be set to decrease as the amount of event information stored in the database decreases.

[0158] Furthermore, for example, the matching of raw data may be performed using clustering determination based on artificial intelligence.

[0159] Furthermore, it may be possible to arbitrarily select which items to use for matching from among the multiple items included in the raw data.

[0160] In the above embodiments, each component may be implemented by dedicated hardware or by executing a software program suitable for each component. Each component may also be implemented by a program execution unit such as a CPU (Central Processing Unit) or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the software that implements the analysis support method, etc., of each of the above embodiments is a computer program that causes a computer to execute each step of the flowchart shown in Figures 2, 5, 6, 8, 10, 11, and 15, respectively.

[0161] The following cases are also included in this disclosure.

[0162] (1) The at least one device described above is specifically a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or hard disk unit. The at least one device described above achieves its function by the operation of the microprocessor in accordance with the computer program. Here, the computer program is composed of a combination of multiple instruction codes that indicate instructions to the computer in order to achieve a predetermined function.

[0163] (2) Some or all of the components constituting at least one of the above-described devices may be made up of a single system LSI (Large Scale Integration). The system LSI is a multi-functional LSI manufactured by integrating multiple components onto a single chip, and specifically, it is a computer system comprising a microprocessor, ROM, RAM, etc. The RAM stores a computer program. The system LSI achieves its function by operating the microprocessor in accordance with the computer program.

[0164] (3) Some or all of the components constituting at least one of the above-described devices may consist of an IC card or a standalone module that is detachable from the device. The IC card or module is a computer system consisting of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-described multi-function LSI. The IC card or module achieves its function by the operation of the microprocessor in accordance with a computer program. The IC card or module may be tamper-resistant.

[0165] (4) The disclosure may also be the methods described above. Alternatively, it may be a computer program that implements these methods using a computer, or a digital signal consisting of a computer program.

[0166] Furthermore, this disclosure may also refer to a computer program or digital signal recorded on a computer-readable recording medium, such as a flexible disk, hard disk, CD (Compact Disc)-ROM, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray® Disc), semiconductor memory, etc. Alternatively, it may refer to a digital signal recorded on such a recording medium.

[0167] Furthermore, this disclosure may also include the transmission of computer programs or digital signals via telecommunications lines, wireless or wired communication lines, networks such as the Internet, data broadcasting, etc.

[0168] Alternatively, the program or digital signal may be carried out by another independent computer system by recording and transferring it on a recording medium, or by transferring the program or digital signal via a network or the like. [Industrial applicability]

[0169] The analytical support methods described herein can be applied to methods for supporting the analysis of events related to monitored targets. [Explanation of Symbols]

[0170] 10,10a SOC 20,20a Analysis support equipment 21 Verification Unit 22 Memory section 23 Display section 24. Authority Determination Department

Claims

1. An analysis support method performed in an analysis support device that assists in the analysis of attack scenarios in an event based on raw data relating to an event that occurred in a monitored target, Obtain the aforementioned raw data, A matching process is performed to compare the acquired raw data with one or more previously acquired raw data. A determination process is executed to determine whether there is any raw data similar to the acquired raw data among the one or more raw data acquired in the past. If the raw data exists, output the past analysis results for that raw data. The raw data includes multiple items, In the aforementioned matching process, The contents of the multiple items contained in the acquired raw data are compared with the contents of the multiple items contained in each of the one or more previously acquired raw data sets. In the aforementioned determination process, If the content of each of the multiple items included in the acquired raw data is the same as the content of the same item among the multiple items included in each of the one or more raw data acquired in the past, points are added. If the content of each of the multiple items included in the acquired raw data is not the same as the content of the same item among the multiple items included in each of the one or more raw data acquired in the past, points are not added or points are deducted. In this way, the score for each of the one or more raw data acquired in the past is calculated. If, among the one or more raw data acquired in the past, there is a raw data whose calculated score is above a predetermined threshold, it is determined that there is a raw data similar to the acquired raw data among the one or more raw data acquired in the past. The points mentioned above are, This is performed based on a predetermined weight coefficient for at least some of the items of the aforementioned plurality of items, In the output of the aforementioned past analysis results, The results of past analysis of previously acquired raw data for which a first score was calculated are output with priority over the results of past analysis of previously acquired raw data for which a second score lower than the first score was calculated. Analysis support method.

2. Further obtain the determination result determined by the security information event management device based on the raw data, In the aforementioned determination process, Determine whether there are any raw data and judgment results similar to the acquired raw data and judgment results among the one or more raw data and one or more judgment results acquired in the past. In the output of the aforementioned past analysis results, If the raw data and the judgment result exist, output the past analysis results for the raw data and the judgment result. The analysis support method according to claim 1.

3. In acquiring the raw data, The raw data is obtained by communicating with the monitored object or by communicating with a database that records the raw data obtained from the monitored object. The analysis support method according to claim 1 or 2.

4. The one or more raw data acquired in the past are divided into one or more groups according to the content of the plurality of items, If, among the one or more groups, there is a group whose content is the same as the content of the multiple items included in the acquired raw data, the acquired raw data is assigned to that group; if, among the one or more groups, there is no group whose content is the same as the content of the multiple items included in the acquired raw data, the acquired raw data is assigned to a new group. The analysis support method according to claim 1 or 2.

5. In the matching process, The contents of the multiple items included in the acquired raw data are compared with the contents of the multiple items relating to each of the one or more groups, In the aforementioned determination process, If the content of each of the multiple items included in the acquired raw data is the same as the content of the same item among the multiple items related to each of the one or more groups, points are added; if the content of each of the multiple items included in the acquired raw data is not the same as the content of the same item among the multiple items related to each of the one or more groups, points are not added or points are deducted, thereby calculating the score for each of the one or more groups. If, among the one or more groups, there is a group whose calculated score is equal to or greater than a predetermined threshold, it is determined that among the one or more raw data acquired in the past, there is raw data similar to the acquired raw data. The analysis support method according to claim 4.

6. In the output of the past analysis results, If such raw data exists, determine whether you have permission to view the aforementioned past analysis results for that raw data. If the aforementioned authority is granted, output the past analysis results for the raw data. The analysis support method according to claim 1 or 2.

7. An analysis support device that assists in the analysis of attack scenarios in an event, based on raw data relating to an event that occurred in a monitored target, The acquisition unit acquires the raw data, A matching process is performed to compare the acquired raw data with one or more previously acquired raw data. A matching unit that performs a determination process to determine whether there is any raw data similar to the acquired raw data among the one or more raw data acquired in the past, If such raw data exists, it includes an output unit that outputs past analysis results for such raw data. The raw data includes multiple items, In the aforementioned matching process, The contents of the multiple items contained in the acquired raw data are compared with the contents of the multiple items contained in each of the one or more previously acquired raw data sets. In the aforementioned determination process, If the content of each of the multiple items included in the acquired raw data is the same as the content of the same item among the multiple items included in each of the one or more raw data acquired in the past, points are added. If the content of each of the multiple items included in the acquired raw data is not the same as the content of the same item among the multiple items included in each of the one or more raw data acquired in the past, points are not added or points are deducted. In this way, the score for each of the one or more raw data acquired in the past is calculated. If, among the one or more raw data acquired in the past, there is a raw data whose calculated score is above a predetermined threshold, it is determined that there is a raw data similar to the acquired raw data among the one or more raw data acquired in the past. The points mentioned above are, This is performed based on a predetermined weight coefficient for at least some of the items of the aforementioned plurality of items, In the output of the aforementioned past analysis results, The results of past analysis of previously acquired raw data for which a first score was calculated are output with priority over the results of past analysis of previously acquired raw data for which a second score lower than the first score was calculated. Analysis support equipment.

8. A program for causing a computer to execute the analysis support method described in claim 1.

Images