Security risk assessment device, security risk assessment method, security risk assessment system, and program

Abstract

A security risk assessment device (60) comprises: a risk identification unit (61) that creates, on the basis of security information about collected information assets, vulnerabilities, and threats, an analysis graph in which the probabilistic dependency between security risks is described in the form of a directed acyclic graph with the sources of external threats added thereto; a risk analysis unit (62) that calculates a risk probability pertaining to the state of a node by using the analysis graph and threat information sensed for the inside of a network by security software installed on a host; and a risk evaluation unit (63) that determines that treatment is needed if a loss cost estimated on the basis of the risk probability and asset value information is greater than or equal to a risk reference.

Description

Security risk assessment device, security risk assessment method, security risk assessment system and program

[0001] The present invention relates to security risk management and security risk assessment of network systems, and more particularly to a security risk assessment device, a security risk assessment method, a security risk assessment system, and a program.

[0002] In recent years, network systems have been exposed to various cyber-attack threats, making security risk management increasingly important. For correct and efficient security risk management, security risk assessment, which accurately identifies and quantitatively analyzes and evaluates security risks in network systems, is essential.

[0003] Security risk assessment involves collecting and analyzing a huge amount of security information to identify, analyze, and evaluate risks. Here, security information includes network configuration management information, vulnerability information, and alerts from intrusion detection systems (IDS) and intrusion prevention systems (IPS).

[0004] Especially in large-scale network systems such as enterprise networks, it is not realistic for system operators to manually perform all of these risk assessment tasks in terms of the time and workload involved. Furthermore, because the environment surrounding network systems and the characteristics and magnitude of the risks they pose change constantly, security risk assessments must be not only accurate but also dynamic and rapid. Therefore, there is a strong demand for automating and mechanizing risk assessment tasks. Such automation and mechanization not only reduce human workloads (human work time and workload), but also speed up the assessment process and prevent human error.

[0005] Non-Patent Document 1 describes a security risk assessment method using a Bayesian Attack Graph (BAG). A BAG is a Bayesian network (BN) for representing the probabilistic dependencies between vulnerabilities inherent in a network system. It comprehensively describes the paths (attack procedures) an attacker can take to attack information assets within the system. In the BAG, nodes represent system states, and edges represent the probability of a system state transition. Here, a system state could be, for example, "a state in which an attacker has gained administrative privileges over a specific information asset (such as a host)," and a system state transition corresponds to "(successful) exploitation of a vulnerability." Using a BAG, the probability of a transition to each system state can be calculated mechanically and quantitatively while taking vulnerability dependencies into account.

[0006] N. Poolsappasit, R. Dewri, and I. Ray, “Dynamic Security Risk Management Using Bayesian Attack Graphs,” IEEE Transactions on Dependable and Secure Computing, vol. 9, no. 1, pp. 61-74, 2012.

[0007] The technology described in Non-Patent Document 1 only considers information on whether or not an external attacker exists, and the threat information that can be considered is limited. In other words, the conventional technology was unable to perform a realistic assessment.

[0008] Therefore, the present invention aims to solve the above problems and automate and mechanize a series of risk assessment tasks that are in line with reality.

[0009] The security risk assessment device of the present invention is characterized by comprising: a risk identification unit that identifies security risks inherent in a network system having multiple hosts and sources of external threats based on security information regarding information assets, vulnerabilities, and threats within the network system, each collected by a plurality of security devices installed in the network system; creates an analytical graph that describes the probabilistic dependencies of the identified security risks in the form of a directed acyclic graph; and adds nodes indicating the sources of the identified external threats to the analytical graph; a risk analysis unit that calculates a risk probability regarding the state of a node using information about threats within the network detected by security software installed on a host in the network system and the analytical graph; and a risk evaluation unit that estimates the loss cost when a risk becomes apparent based on the risk probability calculated by the risk analysis unit and predetermined asset value information, and determines that the risk requires action if the estimated loss cost is equal to or greater than a predetermined risk standard.

[0010] According to the present invention, a series of risk assessment tasks that are in line with reality can be automated and mechanized.

[0011] 3 is a schematic configuration diagram of a system including a security risk assessment device according to a first embodiment of the present invention. FIG. 3 is a schematic diagram of an analysis graph created by the security risk assessment device. FIG. 4 is a flowchart showing the flow of a process for creating an analysis graph. FIG. 4 is a flowchart showing the flow of step S1 in FIG. 3. FIG. 4 is a schematic diagram showing the corresponding relationship between step S1 in FIG. 3 and the analysis graph. FIG. 4 is a schematic diagram showing the corresponding relationship between step S2 in FIG. 3 and the analysis graph. FIG. 4 is a schematic diagram showing an example of a calculation performed in step S2 in FIG. 3. FIG. 4 is a schematic diagram showing the corresponding relationship between step S3 in FIG. 3 and the analysis graph. FIG. 4 is a schematic diagram showing the corresponding relationship between step S4 in FIG. 3 and the analysis graph. FIG. 4 is a flowchart showing the flow of a process for calculating a risk probability related to a node state using the analysis graph. FIG. 4 is a schematic configuration diagram of a system including a security risk assessment device according to a second embodiment of the present invention. FIG. 4 is a schematic diagram of an outbound analysis graph created by the security risk assessment device according to the second embodiment. FIG. 4 is a hardware configuration diagram showing an example of a computer that realizes the functions of the security risk assessment device and each device according to each embodiment of the present invention.

[0012] The security risk assessment device according to this embodiment will be described in detail below with reference to the accompanying drawings. [System Configuration Overview] As shown in FIG. 1, the security risk assessment system 1 includes a network information acquisition unit 10, a host anomaly detection unit 20, an information input unit 30, a data processing unit 40, a database 50, a risk assessment unit (security risk assessment device) 60, and an assessment result output unit 70. The network information acquisition unit 10 automatically collects security information related to information assets, vulnerabilities, and threats within a network system having multiple hosts, the security information being collected by multiple security devices installed within the network system. The host anomaly detection unit 20 acquires detection information related to host anomalies from security software installed on the hosts within the network system. The information input unit 30 accepts input of the value and risk criteria of information assets in the network system. The data processing unit 40 associates the security information acquired by the network information acquisition unit 10 with the time the security information was collected and stores the information in the database 50. The data processing unit 40 also associates the detection information acquired by the host anomaly detection unit 20 with the time at which the detection information was collected and stores the information in the database 50. The risk assessment unit 60 performs risk assessment based on the data stored in the database 50. The assessment result output unit 70 presents the results of the risk assessment to the system administrator 2, etc. Details of each unit of the security risk assessment system 1 will be described below.

[0013] 1, the network information acquisition unit 10 includes a network flow information acquisition unit 11, a vulnerability information acquisition unit 12, and a threat information acquisition unit 13. The network flow information acquisition unit 11 acquires security information related to information assets. The vulnerability information acquisition unit 12 acquires security information related to vulnerabilities. The threat information acquisition unit 13 acquires security information related to threats.

[0014] The network information acquisition unit 10 can use commercially available products. The network flow information acquisition unit 11 can use a network flow collector installed in the network. The network flow collector can obtain statistical information on packets flowing through a router. The vulnerability information acquisition unit 12 can use a vulnerability scanner installed in the network. The threat information acquisition unit 13 can use a NIDS (Network Intrusion Detection System), NIPS (Network Intrusion Prevention System), or WAF (Web Application Firewall) installed in the network. Information obtained from various security products by the network information acquisition unit 10 includes logs, alerts, and detection results.

[0015] [Host Anomaly Detection Unit 20] The host anomaly detection unit 20 acquires detection information related to host anomalies from security products installed on each host. Here, host anomalies refer to, for example, virus infections, suspicious behavior, exploitation of vulnerabilities, etc. In this embodiment, the host anomaly detection unit 20 acquires information from systems such as a HIDS (Host Intrusion Detection System) or an EDR (Endpoint Detection and Response) system installed on each host. Details of the information acquired by the host anomaly detection unit 20 will be described later.

[0016] [Information Input Unit 30] The information input unit 30 receives input of the value of an information asset and risk criteria from, for example, a system administrator. The value of an information asset is the cost of loss when a risk becomes apparent. Hereinafter, the value of an information asset will also be referred to as asset value. The information input from the information input unit 30 is stored in the database 50 along with various other security information. The information input from the information input unit 30 is transmitted from the database 50 to the risk assessment unit 63. Details of the information acquired by the information input unit 30 will be described later.

[0017] [Data Processing Unit 40, Database 50] The data processing unit 40 appropriately organizes and formats the various security information acquired by the network information acquisition unit 10, host anomaly detection unit 20, and information input unit 30, and stores the information in the database 50. The information shown in Tables 1 to 3 below is stored in the database 50. Here, the information shown in Table 1 is mainly acquired by the network information acquisition unit 10 and is used by the risk identification unit 61.

[0018]

[0019] In this specification, a tuple of a host and a starting port is called a "starting interface." A tuple of a host and a finishing port is called a "finishing interface." For convenience, data will also be expressed using symbols. Let the host be h, the starting port be s, and the finishing port be d. The starting interface is expressed as i = (h, s). The finishing interface is expressed as j = (h, d). Let v be a vulnerability, and the vulnerability v inherent in host h is expressed as vulnerability node u = (h, v).

[0020] As will be described later, the database 50 receives a "certain period" as a query from the risk identification unit 61, and provides the risk identification unit 61 with the data flow for each interface during that period, the unit-time average number of malicious communications, and vulnerability information inherent in each host during that period. Therefore, to satisfy this requirement, these data are managed and saved together with time information. Such processing is performed in advance by the data processing unit 40, and the database 50 also satisfies this requirement.

[0021] The database 50 stores the information shown in Table 2 below together with the information shown in Table 1. The information shown in Table 2 is mainly acquired by the host abnormality detection unit 20 and used by the risk analysis unit 62.

[0022]

[0023] The "starting interface (or ending interface) related to abnormal host behavior" is, for example, information about an interface that transmits or receives traffic that shows an unusual pattern in terms of traffic volume, protocol, or the nature of data stored in packets. The "vulnerability related to abnormal host behavior" is, for example, information about an alert indicating that a vulnerability has been exploited. However, this information is only stored when a security product installed on the host detects an abnormality. Therefore, this information is not necessarily stored in the database 50 all the time.

[0024] As will be described later, the database 50 receives a "certain period" as a query from the risk analysis unit 62, and provides the risk analysis unit 62 with "information related to host abnormalities" detected during that period. Therefore, to satisfy this requirement, these data are managed and saved together with time information. Such processing is performed in advance by the data processing unit 40, and the database 50 also satisfies this requirement.

[0025] The database 50 stores the information shown in Table 3 below together with the information shown in Tables 1 and 2. The information shown in Table 3 is mainly obtained by the information input unit 30 (i.e., input by the system administrator) and used by the risk assessment unit 63.

[0026]

[0027] An "asset value" is assigned to each end interface node. Alternatively, an "asset value" is assigned to each start interface node. Alternatively, an "asset value" is assigned to each vulnerability node. As an example, a case where an asset value is assigned to an end interface node will be described. For example, a system administrator or the like assigns asset values ​​as real numbers to all end interface nodes on an analysis graph. Alternatively, a system administrator or the like assigns asset values ​​as real numbers to some (particularly important) end interface nodes on an analysis graph.

[0028] For example, assume that there is an information asset in the target network system that satisfies the following conditions 1 to 3. (Condition 1) An application (e.g., a database) on host h stores important business information for the company. (Condition 2) That application is accessible from destination port d on host h. (Condition 3) The estimated loss cost if the company's important business information were lost or leaked is 50 million yen. In this case, "50 million yen" is entered as the asset value for the corresponding destination interface node (h, d) in the analysis graph. Note that the asset value entered is not limited to a monetary amount; it could also be, for example, the man-hours (man-months) required for risk treatment. The "risk standard" is entered as the upper limit (expected value) of the tolerable loss cost.

[0029] [Risk Assessment Unit 60] The risk assessment unit 60 calculates the "probability that unauthorized communications reach each asset (interface) in a certain period of time" and the "probability that each vulnerability is exploited in a certain period of time" based on the information in the database 50. To do this, the risk assessment unit 60 uses a directed acyclic graph such as that shown in Fig. 2. Hereinafter, such a directed acyclic graph will be referred to as an analytical graph.

[0030] The analysis graph describes, as nodes, the source interface (Src Interface) and destination interface (Dst Interface) within the network system, as well as the vulnerabilities inherent in each host. The analysis graph also describes, as edges and their weights, the probability that unauthorized communication from outside will propagate between interfaces, and the probability that this will lead to a vulnerability attack.

[0031] Each node has its own state variable. If the node is an interface node, the state variable is a binary variable indicating whether unauthorized communication has arrived (1) or not (0). If the node is a vulnerable node, the state variable is a binary variable indicating whether the node has been exploited (1) or not (0). The risk assessment unit 60 calculates the probability that each of these state variables will be 1 (i.e., the expected value of each state variable) based on graph theory, thereby calculating the probability that unauthorized communication from outside will propagate between interfaces and the probability that this will lead to a vulnerability attack.

[0032] In addition, since the nodes of the BN in the conventional technology described in Non-Patent Document 1 represent the system state (unique combinations of system variables), when attempting to apply this conventional technology to a large-scale network, there is a problem that the system variables will cause a combinatorial explosion, making it difficult to create the BN itself from the perspective of computational cost. In contrast, the nodes of the BN created by the risk assessment unit 60 represent ports or vulnerabilities in the host, so the graph is less likely to become bloated, making it possible to apply it to large-scale networks.

[0033] As shown in FIG. 1 , the risk assessment unit 60 includes a risk identification unit 61, a risk analysis unit 62, and a risk evaluation unit 63. The risk identification unit 61 identifies security risks inherent in the network system and sources of external threats based on security information, creates an analysis graph that describes the probabilistic dependencies of the identified security risks in the form of a directed acyclic graph, and adds nodes indicating the sources of the identified external threats to the analysis graph. Here, external threats refer to external suspicious hosts and applications. The risk analysis unit 62 calculates risk probabilities related to the state of the nodes using information about threats within the network detected by security software installed on hosts in the network system and the analysis graph. The risk evaluation unit 63 estimates the loss cost when a risk materializes based on the risk probability calculated by the risk analysis unit 62 and predetermined asset value information. If the estimated loss cost is equal to or exceeds a predetermined risk standard, the risk is determined to require action. Details of each unit of the risk assessment unit 60 are described below.

[0034] [Risk Identification Unit 61] Based on information obtained from the network information acquisition unit 10 during a certain period, the risk identification unit 61 identifies risks inherent in the network system during that period and describes their probabilistic dependencies as an analytical graph. To do this, a system administrator or the like specifies an arbitrary period t in the past. The period t may be, for example, the period from five minutes ago to the present. The risk identification unit 61 sequentially executes the following processes. The risk identification unit 61 inputs the period t into the database 50 as a query and acquires various information for that period. The risk identification unit 61 uses the information obtained from the database 50 as input to create an analytical graph to be used for risk analysis. The risk identification unit 61 inputs the created analytical graph to the risk analysis unit 62.

[0035] Next, the flow of processing by the risk identification unit 61 to create an analysis graph will be described with reference to FIG. 3 (and FIG. 2 as appropriate). The risk identification unit 61 identifies dependencies between hosts over a predetermined period of time t (step S1). Here, the risk identification unit 61 describes the dependencies between hosts based on data flow and alert information. Then, the risk identification unit 61 identifies dependencies between interfaces between host groups (step S2). Here, the risk identification unit 61 calculates and describes dependencies between ports (interfaces), i.e., the probability that unauthorized communication will flow between interfaces, in accordance with the dependencies between hosts identified in step S1.

[0036] The risk identification unit 61 then identifies the dependency relationship between the destination interface and the vulnerability within each host (step S3). Here, the risk identification unit 61 calculates and describes the probability that the vulnerability will be accessed from the destination port (destination interface) and exploited. Then, the risk identification unit 61 identifies the dependency relationship between the vulnerability and the initiation interface within each host (step S4). Here, the risk identification unit 61 calculates and describes the probability that unauthorized communication will be performed from the initiation port (initiation interface) after the vulnerability is exploited. Then, the risk identification unit 61 sets the state variables of each node within each host based on the alert information (step S5). Then, the risk identification unit 61 adds an external interface based on the alert information (step S6).

[0037] Steps S1 to S6 will be described in detail below with reference to the drawings and formulas. (Step S1) In step S1, the risk identification unit 61 identifies the dependency relationships L0, L1, L2, ....L between the hosts during the period t. l Here, L l is a set of hosts whose "distance" from the Internet (outside) is l. A list of hosts whose distance from the outside is l is called a list L. lList L0 lists the hosts that have directly received unauthorized communications from outside. List L1 contains hosts that have received direct communications from hosts that belong to the list immediately preceding it, List L0. Similarly, lists L2 and onwards contain hosts that have received direct communications from hosts that belong to the list immediately preceding it. The value of l is determined automatically based on the input information (network environment). Furthermore, if the host that conducted the communications does not exist in the first place, these dependencies cannot be obtained, so a graph cannot be created and an assessment cannot be carried out.

[0038] Next, a detailed processing flow of step S1 will be described with reference to Fig. 4 and Fig. 5. Fig. 5 shows the dependency relationships L0, L1, L2, ..., L between hosts when the risk identification unit 61 has completed the process of creating the analysis graph. l In order to create this analysis graph, the risk identification unit 61 first creates a list L of hosts that have performed communication (alerts, network flows) during the period t. A (Step S11). A Initially, all hosts for which an alert was generated due to external communication within the period t, or all hosts that have performed some kind of communication with other hosts within the network system, are listed in list L. Then, in the following process, the risk identification unit 61 creates a list L according to the dependency relationships between hosts. A Updates are made to sequentially remove hosts from the

[0039] Next, the risk identification unit 61 creates a list L A Among these, the hosts that received malicious communication (alerts) from the outside during the period t are listed in list L0 (step S12). As shown in FIG. 5, all hosts that received alerts are listed in list L0 in proximity to the outside (Internet). Then, the risk identification unit 61 determines whether list L0 is empty (step S13). If list L0 is not empty (step S13: No), the risk identification unit 61 adds the hosts in list L0 to list L A (Step S14), and delete it from the list L AThe risk identification unit 61 updates the list L as follows: A list L until it is empty A First, the risk identification unit 61 updates the list L A It is determined whether the list L is empty (step S15). A If is not empty (step S15: No), the risk identification unit 61 sets the value of the distance l from the Internet (external) to 0 (l ← 0: step S16), and performs the following repeated processing.

[0040] In the repeated processing, first, the risk identification unit 61 identifies the list L l Among the hosts that directly received communication (network flow) from each host in list L A List of what's included in L l+1 (Step S21). If the value of the distance l is 0 in Step S21, the list L l+1 In this case, list L1 lists all hosts that have directly received communication (network flow) from each host in list L0, in close proximity to list L0, as shown in FIG.

[0041] Following step S21, the risk identification unit 61 creates a list L l+1 It is determined whether the list L is empty (step S22). l+1 is not empty (step S22: No), the risk identification unit 61 l+1 List hosts in L A (step S23), and delete it from list L A Next, the risk identification unit 61 updates the list L A It is determined whether the list L is empty (step S24). A is not empty (step S24: No), the risk identification unit 61 increments the value of l (l ← l+1: step S25) and returns to step S21. Note that if the value of the distance l is 1 in step S21, the list L l+1In this case, list L2 lists all hosts that have directly received communication (network flow) from each host in list L1, in close proximity to list L1, as shown in FIG. 5. Similarly, in step S21, l As shown in Figure 5, 1-1 All hosts that have directly received communication (network flow) from each host in the list L 1-1 are listed close to

[0042] On the other hand, in step S24, list L A is empty (step S24: Yes), the risk identification unit 61 increments the value of l (l ← l+1: step S26) and sets L0, L1, L2, . . . L as the dependency relationships between the hosts at that time. l (step S27), and the process ends. l+1 If the list L is empty (step S22: Yes), the risk identification unit 61 proceeds to step S27. A If the list L0 is empty (step S15: Yes), the risk identification unit 61 obtains L0 as the dependency relationship between the hosts at that time (step S28) and ends the process. Also, if the list L0 is empty in step S13 (step S13: Yes), the risk identification unit 61 ends the process.

[0043] (Step S2) In step S2, the risk identification unit 61 calculates the conditional probability that malicious communication will occur between each start-point interface node and each end-point interface node, and creates an edge with the calculated value as a weight. The edge is a group of hosts (L n ) and host groups (L n+1 ) where the source interface node i=(h i ,s), h i ∈L n When malicious communication reaches the source interface node i=(h i ,s), h i ∈L n and destination interface node j=(hj ,d), h j ∈L n+1 The conditional probability of malicious communication occurring between and is given by p ij This probability p ij is expressed as the weight of the edge between node i and node j.

[0044] 6A is a schematic diagram showing the correspondence between step S2 and the analysis graph. In the analysis graph shown in FIG. 6A, for example, an area 201 surrounded by a virtual line schematically shows communication occurring between a start interface node of a host belonging to host group L0 and a finish interface node of a host belonging to host group L1. Also, for example, an area 202 surrounded by a virtual line schematically shows communication occurring between a start interface node of a host belonging to host group L1 and a finish interface node of a host belonging to host group L2.

[0045] In step S2, the risk identification unit 61 normalizes the ratio of the network flows to obtain a probability p ij In this case, the risk identification unit 61 determines the probability p ij Ask for.

[0046]

[0047] In formula (1), μ ij is the network flow between the source interface node i and the destination interface node j. i is the total amount of network flow sent from source interface node i.

[0048] Next, the probability p ij 6B, for example, when the network flows (communication volumes) from a start interface node i to end interface nodes j1, j2, and j3 are 2, 5, and 4, respectively, the total network flow volume ρ sent from the start interface node i is iis 11. Therefore, according to equation (1), the probabilities that communication will occur from the source interface node i to the destination interface nodes j1, j2, and j3 are 2 / 11, 5 / 11, and 4 / 11, respectively.

[0049] Note that the system administrator ij Alternatively, the system administrator may assign an arbitrary probability value as p ij An alternative method for calculating

[0050] (Step S3) In step S3, the risk identification unit 61 calculates the "probability that each vulnerable node will be exploited after being accessed from each end interface node," and creates an edge with the calculated value as a weight. The edge is defined between an end interface (port) node and a vulnerable node in the same host. Here, when malicious communication has reached end interface node j=(h,d), the conditional probability that vulnerable node u=(h,v) will be accessed from end interface node j=(h,d) is defined as q ju Then, the conditional probability that the vulnerable node u is exploited is w u In addition, the weight of the edge between the destination interface node j and the vulnerable node u is q ju ×w u Let's say.

[0051] 7 is a schematic diagram showing the correspondence between step S3 and the analysis graph. In the analysis graph shown in FIG. 7, for example, an area 301 surrounded by a virtual line schematically shows access from an end interface node to a vulnerable node in a host belonging to host group L0. An area 302 surrounded by a virtual line schematically shows access from an end interface node to a vulnerable node in a host belonging to host group L1. An area 303 surrounded by a virtual line schematically shows access from an end interface node to a vulnerable node in a host belonging to host group L2. An area 304 surrounded by a virtual line schematically shows access from an end interface node to a vulnerable node in a host belonging to host group L3. l 10 shows a schematic diagram of access from a destination interface node to a vulnerable node within a host belonging to the

[0052] Probability q ju is defined as a binary value, for example, 0 or 1. For example, it can be defined as 1 if application a containing vulnerability v uses d as the destination port, and 0 otherwise. Also, the probability w u can be calculated using a calculation method based on the Common Vulnerability Scoring System (CVSS), for example. The calculation method based on CVSS is described in Non-Patent Document 1, etc.

[0053] Note that the system administrator ju And probability w u The system administrator may assign any probability value as ju And probability w u An alternative method for calculating

[0054] (Step S4) In step S4, the risk identification unit 61 calculates the "probability that unauthorized communication will be performed from each start interface node after each vulnerable node is exploited" and creates an edge with the calculated value as a weight. The edge is defined between a vulnerable node and a start interface (port) node in the same host. Here, when the vulnerable node u=(h,v) is exploited, the probability that the start interface node i=(h,s) will be accessed from the vulnerable node u=(h,v) is defined as r ui This probability r ui is expressed as the weight of the edge between node u and node i.

[0055] 8A is a schematic diagram showing the correspondence between step S4 and the analysis graph. In the analysis graph shown in FIG. 8A, for example, an area 401 surrounded by a virtual line schematically shows access from a vulnerable node to an initiation interface node in a host belonging to host group L0. An area 402 surrounded by a virtual line schematically shows access from a vulnerable node to an initiation interface node in a host belonging to host group L1. An area 403 surrounded by a virtual line schematically shows access from a vulnerable node to an initiation interface node in a host belonging to host group L2.

[0056] The probability r calculated by the risk identification unit 61 ui For example, let us assume that the source port used by the host is random, and the ratio of network flows sent from each source interface node is simply expressed as probability r ui In this case, the risk identification unit 61 determines the probability r ui In equation (2), ρ i is the total amount of network flow sent from source interface node i.

[0057]

[0058] Next, the probability r calculated by the risk identification unit 61 uiA specific example of this will be described with reference to Figure 8B. Figure 8B is a schematic diagram illustrating the following conditions 1 to 4: (Condition 1) A network flow is sent from each of the ingress interface nodes i1, i2, and i4, and the other ingress interface nodes, including i3, are not sending any network flows. (Condition 2) The total amount of network flows sent from ingress interface node i1 is 6. (Condition 3) The total amount of network flows sent from ingress interface node i2 is 8. (Condition 4) The total amount of network flows sent from ingress interface node i4 is 15. In this case, the total amount of network flows sent from all ingress interface nodes within the host is 29. Therefore, according to equation (2), the probabilities that vulnerable node u will access ingress interface nodes i1, i2, and i4 are 6 / 29, 8 / 29, and 15 / 29, respectively.

[0059] In addition, the system administrator determines the probability r ui The system administrator may assign any probability value as r ui An alternative method for calculating

[0060] (Step S5) In step S5, the risk identification unit 61 defines and sets state variables for each start interface node, end interface node, and vulnerable node. The risk identification unit 61 defines and sets state variables M i Define the state variable M i is a binary variable that is 1 if an unauthorized communication has arrived, and 0 otherwise. i The initial value of is set to 0. The risk identification unit 61 determines whether or not unauthorized communication has reached the destination interface node j by setting a state variable M j Define the state variable M j is a binary variable that is 1 if an unauthorized communication has arrived, and 0 otherwise. j The initial value of is set to 0. The risk identification unit 61 sets a state variable Eu Define the state variable E u is a binary variable that is 1 if it is exploited and 0 otherwise. The state variable E u The initial value of is set to 0.

[0061] In step S5, the risk identification unit 61 calculates the state variable M j That is, the risk identification unit 61 calculates the state variable M j In equation (3), λ j is the unit time average of the number of unauthorized communications (IDS alerts and IPS alerts) received by destination interface j.

[0062]

[0063] Note that the system administrator can set this status variable M j Another way of setting may be provided.

[0064] (Step S6) In step S6, the risk identification unit 61 adds the initiation interface from which malicious communication was initiated from outside the network system to the analysis graph created by the process up to step S5 (see FIG. 2). This initiation interface, which is external to the network system and caused the alert, is the external malicious interface. The analysis graph shown in FIG. 2 differs from the analysis graphs shown in FIGS. 5, 6A, 7, and 8A in that a node indicating the external malicious interface has been added. This makes it possible to identify and visualize the IP addresses and port numbers of hosts that have initiated malicious or suspected malicious communication, thereby specifically identifying the source of the threat.

[0065] Information on external malicious interfaces is acquired by the network information acquisition unit 10 and stored in the database 50 as shown in item 2 of Table 1. Item 2 of Table 1 includes information on the starting interface that performed unauthorized communication from the outside to the ending interface within the network system. This completes the processing of the risk identification unit 61, and the created analysis graph is sent to the risk analysis unit 62.

[0066] [Risk analysis unit 62] The risk analysis unit 62 sequentially executes the following processes. The risk analysis unit 62 acquires an analysis graph from the risk identification unit 61. The risk analysis unit 62 acquires information on host abnormalities from the database 50 as threat information within the network. The risk analysis unit 62 calculates a risk probability related to the node state using the analysis graph acquired from the risk identification unit 61 and the information on host abnormalities acquired from the database 50. The risk analysis unit 62 inputs the obtained risk probability of each node to the assessment result output unit 70 and the risk evaluation unit 63.

[0067] Next, the flow of processing by the risk analysis unit 62 to calculate risk probability will be described with reference to FIG. 9 (and also with reference to FIG. 1 and FIG. 5 as appropriate). FIG. 9 is a flowchart showing the flow of processing to calculate risk probability. Note that the calculation and update methods of state variables will be described later. First, the risk analysis unit 62 generates a list L that specifies the dependency relationships between hosts. n The value of the identifier n is set to 0 (n←0: step S31).

[0068] Then, if an "interface related to a host abnormality" or a "vulnerability related to a host abnormality" has been detected for a certain host (if it has been stored in the database 50), the risk analysis unit 62 updates the state variables of the interface node and vulnerability node to non-zero values ​​(step S32). A non-zero value indicates a probability value that is not 0. This value may be determined by a system administrator or the like in any way based on the severity of the abnormality detected in the host. Also, if the appropriate value is unknown, the most pessimistic value, i.e., 1, may be used. However, in the list L nIf no abnormality has been detected in any of the hosts (if no abnormality is stored in the database 50), step S32 is omitted.

[0069] Then, the risk analysis unit 62 creates a list L n For all hosts in list L0, the probability that the state variable of each end interface node will be 1 (expected value of the state variable) is calculated, and this is substituted and updated as the value of the new state variable (step S33). However, when n=0 (i.e., for the group of hosts belonging to list L0), the risk identification unit 61 has already set the state variable of the end interface node, so step S33 is omitted. Then, the risk analysis unit 62 calculates the probability that the state variable of each end interface node will be 1 (expected value of the state variable) for all hosts in list L0. n For all hosts in the list L, the probability that the state variable of each vulnerable node will be 1 (expected value of the state variable) is calculated, and this is substituted as the value of the new state variable and updated (step S34). Then, the risk analysis unit 62 determines whether n=l (step S35). If n=l is not the case (step S35: No), the risk analysis unit 62 n For all hosts in the list, the risk analysis unit 62 calculates the probability that the state variable of each start interface node will be 1 (expected value of the state variable), and assigns and updates the value of the new state variable (step S36). Next, the risk analysis unit 62 increments the value of n (n ← n+1: step S37) and returns to step S32. On the other hand, if n=1 in step S34 (step S35: Yes), the risk analysis unit 62 ends the process of calculating the risk probability.

[0070] The risk analysis unit 62 describes the inbound analysis graph by sequentially calculating and updating the values ​​(expected values) of the state variables of each node along the direction of the edge from the outside to the inside of the network system. Here, the risk analysis unit 62 calculates the weight of each edge by regarding it as a conditional probability related to the state variables. In other words, the risk analysis unit 62 calculates by regarding the analysis graph as a BN.

[0071] Details of steps S33, S34, and S36 are explained below. (Step S33) In step S33, the risk analysis unit 62 performs calculations by regarding the weight of the edge extending from the start interface node to the end interface node as "the probability that unauthorized communication will reach the end interface node if unauthorized communication has reached the start interface node." When the risk analysis unit 62 regards the analysis graph as a BN and calculates the probability that the state variable of the end interface node will be 1, this becomes the risk probability as is. The risk probability in this case is the probability that unauthorized communication has reached the end interface node.

[0072] (Step S34) In step S34, the risk analysis unit 62 performs calculations by regarding the weight of the edge extending from the destination interface node to the vulnerable node as "the probability that the vulnerable node will be exploited when unauthorized communication reaches the destination interface node." When the risk analysis unit 62 regards the analysis graph as a BN and calculates the probability that the state variable of the vulnerable node will be 1, this becomes the risk probability as is. The risk probability in this case is the probability that the vulnerable node is exploited.

[0073] (Step S36) In step S36, the risk analysis unit 62 performs calculations by regarding the weight of the edge extending from the vulnerable node to the start interface node as "the probability that unauthorized communication will be performed from the start interface node if the vulnerable node is exploited." When the risk analysis unit 62 regards the analysis graph as a BN and calculates the probability that the state variable of the start interface node will be 1, this becomes the risk probability. In this case, the risk probability is the probability that unauthorized communication will reach the start interface node. The risk analysis unit 62 may apply a BN calculation method using a Conditional Probability Table (CPT).

[0074] In steps S33, S34, and S36, the calculation method by which the risk analysis unit 62 obtains each risk probability is not limited to the BN calculation method using CPT. The risk analysis unit 62 can also obtain a risk probability by calculating the probability that the state variable of the destination interface node will be 1 using the following formula (4). The risk analysis unit 62 can also obtain a risk probability by calculating the probability that the state variable of the vulnerable node will be 1 using the following formula (5). The risk analysis unit 62 can also obtain a risk probability by calculating the probability that the state variable of the source interface node will be 1 using the following formula (6).

[0075]

[0076] Here, if an edge with a non-zero weight extends from node A to node B, node A is called the parent node of node B. In equation (4), P j is the set of parent nodes of the destination interface node j. In equation (5), P u is the set of parent nodes of the vulnerable node u. In equation (6), P i is the set of parent nodes of the starting interface node i. The calculation methods shown in equations (4), (5), and (6) are likely to be faster than the calculation method for BN using CPT.

[0077] However, for a node that has been detected as an "interface related to a host abnormality" or a "vulnerability related to a host abnormality" and whose state variable has been updated first, the risk analysis unit 62 gives priority to the value stored earlier. That is, for a node whose state variable has been updated to a non-zero value in step S32, the risk analysis unit 62 discards the value calculated from the state variable of the parent node using equation (4), equation (5), or equation (6). This completes the processing of the risk analysis unit 62, and the calculated risk probability is sent to the assessment result output unit 70 and the risk evaluation unit 63.

[0078] [Risk Assessment Unit 63] The risk assessment unit 63 calculates an estimated loss cost using asset value information input by a system administrator, etc. and the risk probability calculated by the risk analysis unit 62, and compares the estimated loss cost with a risk standard to determine the acceptability of the risk.

[0079] As an example, a case will be described in which an asset value is assigned to a destination interface node. The risk assessment unit 63 calculates the expected value of the loss cost for all destination interface nodes from their risk probability and asset value. At this time, for nodes for which no asset value has been input, a default value may be determined in advance in accordance with some policy. The risk assessment unit 63 stores the calculated information in the database 50 or the like so that it can be referenced by a system administrator or the like. Therefore, even when the risk is considered to be acceptable, the system administrator or the like can refer to the information on the estimated loss cost calculated by the risk assessment unit 63.

[0080] The risk assessment unit 63 can determine the acceptability of the risk by comparing the calculated estimated loss cost with the risk standard. For interfaces or vulnerable nodes that are determined to be particularly unacceptable (i.e., requiring action), the risk assessment unit 63 not only determines the estimated loss cost, but also specifically identifies the external interfaces (i.e., threat sources) that are ancestor nodes of the interfaces or vulnerable nodes in the analysis graph.

[0081] The risk assessment unit 63 determines whether the estimated loss cost is equal to or greater than the risk standard (threshold), using the risk standard as a threshold, and determines that the risk is acceptable if the estimated loss cost is smaller than the risk standard. On the other hand, if the estimated loss cost is equal to or greater than the risk standard, the risk assessment unit 63 determines that the risk requires action.

[0082] As an example, assume that a system administrator or the like inputs "1 million yen" as the risk standard using the information input unit 30. In this case, if the estimated loss cost is less than 1 million yen, the risk assessment unit 63 considers the risk to be "acceptable" and does not notify the system administrator or the like of the assessment result (however, the system administrator or the like will be able to refer to the information). Conversely, if the estimated loss cost exceeds 1 million yen, the risk assessment unit 63 notifies the system administrator or the like of the specific estimated loss cost, as well as the locations and risk probabilities of interfaces and vulnerabilities that are deemed to require particular attention.

[0083] The risk assessment unit 60 can specifically identify external threats. In comparison, the prior art described in Non-Patent Document 1, for example, only considers the probability of an external attacker's presence and ignores the source of the threat (e.g., the IP address, application, or protocol used by the attacker). In addition, the prior art described in Non-Patent Document 1 only estimates the probability of transition to each system state (i.e., each node) based on the probability of an external attacker's presence (the probability value assigned to the root node), but does not perform an assessment that takes into account actual threat information such as alerts. In contrast, the risk assessment unit 60 can not only specifically identify external threats, but also perform security risk assessments that take into account alerts detected within the network. Therefore, the risk assessment unit 60 can automate and mechanize a series of realistic risk assessment tasks.

[0084] [Assessment Result Output Unit 70] The assessment result output unit 70 provides the various risk probabilities (i.e., assessment results) received from the risk assessment unit 60 to the system administrator 2, etc. The assessment result output unit 70 may provide the results to the system administrator, etc., after processing the data, such as by determining a threshold value for the risk probability or sorting the data. This allows the system administrator, etc., to obtain assessment results that are easier to understand. By referring to the risk probabilities, the system administrator, etc. can take risk countermeasures such as prioritizing patching of vulnerabilities with higher risk probabilities. Furthermore, by referring to the risk probabilities, the system administrator, etc. can take risk countermeasures such as prioritizing analysis of IDS alerts or IPS alerts related to ports with higher risk probabilities.

[0085] As described above, the risk assessment unit 60 according to the first embodiment can automate and mechanize risk identification, risk analysis, and risk evaluation in security risk assessment work. Such automation and mechanization not only reduces human labor (human work time and workload) but also contributes to accelerating assessments. Furthermore, the security risk assessment system 1 according to the first embodiment can seamlessly automate processes from information collection to risk identification, risk analysis, and risk evaluation. Furthermore, automation makes it easier for system administrators without advanced specialized knowledge to perform risk assessments, minimizing the possibility of human error.

[0086] Second Embodiment Next, a security risk assessment system 1B according to a second embodiment will be described with reference to Fig. 10. Note that the same components as those in the security risk assessment system 1 shown in Fig. 1 are designated by the same reference numerals and will not be described again. The security risk assessment system 1B differs from the security risk assessment system 1 in that the risk assessment unit 60B has a loopback that sends information from the risk assessment unit 63 to the risk identification unit 61.

[0087] [Risk Assessment Unit 60B] As shown in FIG. 10 , the risk assessment unit 60B includes a risk identification unit 61, a risk analysis unit 62, and a risk evaluation unit 63. The risk identification unit 61 acquires risks that have been determined to require a response by the risk evaluation unit 63. The risk identification unit 61 describes an outbound analysis graph by identifying dependency relationships between nodes along the direction of edges pointing outward, with a node indicating a risk in the analysis graph as the root node. The risk identification unit 61 outputs the outbound analysis graph to the risk analysis unit 62. Below, details of each unit of the risk assessment unit 60B will be described, focusing on differences from the first embodiment.

[0088] [Risk Identification Unit 61] In the risk assessment unit 60B, the risk identification unit 61 has the same function as in the first embodiment, namely, the function of generating an analysis graph. Here, the "analysis graph" is a directed acyclic graph that focuses on the inbound network flow from an external network to the system, as shown in FIG. 2, for example. This is used to describe malicious communications from the external network to the inside of the system. Hereinafter, this analysis graph will be referred to as the original analysis graph or the inbound analysis graph. In contrast, the outbound analysis graph is a directed acyclic graph that focuses on the network flow that flows from the inside of the system to the external network (in the outbound direction).

[0089] The reason for focusing on outbound network flows here is to consider realistic malicious communications. One of the main goals of attackers is to steal important information from within a system. When internal information is leaked to the outside, malicious network flows naturally flow from within the system to the external network (in the outbound direction). In other words, malicious network flows flow in the outbound direction. Therefore, it is also important to conduct risk assessments that focus on not only inbound but also outbound network flows as a realistic task. To this end, the risk identification unit 61 receives a list of risks (interfaces and vulnerabilities) that the risk assessment unit 63 has determined to require action, and for each risk, it writes an "outbound analysis graph" (see FIG. 11) and outputs it to the risk analysis unit 62.

[0090] The method for creating an outbound analysis graph is almost the same as the method for creating an inbound analysis graph, with the following three differences in the creation procedure: (1-1) The interface node or vulnerability node determined to require action by the risk assessment unit 63 (rather than the node where an alert occurred) is set as the root node. (1-2) The outbound network flow (rather than the inbound network flow) from the root node is described until it reaches an external interface. (1-3) Dummy vulnerability nodes can be added as appropriate.

[0091] The reason for adding dummy vulnerability nodes here is to take into account the following malicious communications. Usually, outbound communications are much easier than intrusion from the outside into the inside. Therefore, outbound communications that do not involve exploiting vulnerabilities are also expected. In order to take into account such malicious communications, the risk identification unit 61 can add any number of dummy vulnerability nodes to each host in the outbound analysis graph. In this case, the risk identification unit 61 determines the edges of exploit access and their weights (probabilities) q ju , r ui can be determined arbitrarily.

[0092] [Risk Analysis Unit 62] In the risk assessment unit 60B, the risk analysis unit 62 has the same function as in the first embodiment, i.e., the function of analyzing the analysis graph and calculating the risk probability of each node. In particular, the method by which the risk analysis unit 62 analyzes the inbound analysis graph is exactly the same as in the first embodiment. Meanwhile, the method by which the risk analysis unit 62 analyzes the outbound analysis graph is also almost the same as the method by which the risk analysis unit 62 analyzes the inbound analysis graph, but differs in the following two points: (2-1) As the value of the state variable of the root node, the state variable value of the same node in the inbound analysis graph (instead of 1) is used. (2-2) With regard to the state variables of nodes other than the root node, either a value calculated by tracing the dependency starting from the root node (a value calculated using the same procedure as in the first embodiment) or a state variable value of the same node in the inbound analysis graph can be arbitrarily selected and used. For example, suppose that for a vulnerability node other than the root node, the state variable value calculated by tracing the dependency from the root node is "0.7," while the state variable of the same node in the inbound analysis graph is "0.87." In this case, the larger of the two values ​​(the pessimistic value), "0.87," can be adopted as the state variable of that vulnerability node. Note that although multiple outbound analysis graphs may be input to the risk analysis unit 62 from the risk identification unit 61, the risk analysis unit 62 analyzes the outbound analysis graphs one by one.

[0093] [Risk Assessment Unit 63] In the risk assessment unit 60B, the risk assessment unit 63 has the same functions as in the first embodiment, i.e., it calculates an estimated loss cost using the information asset information in the database 50 and the risk probability obtained from the risk analysis unit 62, and compares the estimated loss cost with a risk standard to determine the acceptability of the risk. In particular, the method by which the risk assessment unit 63 processes the inbound analysis graph is exactly the same as in the first embodiment. The risk assessment unit 63 can also determine the acceptability of the risk by processing the outbound analysis graph in the same way as the method for processing the inbound analysis graph. The risk assessment unit 63 can also identify suspicious external interfaces through which particularly suspicious communications are flowing based on their risk probability (state variable value) (e.g., by extracting external interfaces with a risk probability exceeding a certain threshold) and output it as threat information. Furthermore, by tracking outbound flows, the risk assessment unit 63 can identify the destination of data flowing out from an interface that is (highly likely to be) under attack, leading to rapid risk response operations such as packet filtering.

[0094] [Hardware Configuration] The risk assessment unit (security risk assessment device) 60, 60B according to each of the above-described embodiments is realized by a computer 900 having a configuration such as that shown in Fig. 12. Fig. 12 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the risk assessment unit 60, 60B according to this embodiment. The computer 900 has a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM (Random Access Memory) 903, an HDD (Hard Disk Drive) 904, an input / output I / F (Interface) 905, a communication I / F 906, and a media I / F 907.

[0095] The CPU 901 operates based on programs stored in the ROM 902 or the HDD 904. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started up, programs related to the hardware of the computer 900, and the like.

[0096] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output I / F 905. The CPU 901 acquires data from the input device 910 via the input / output I / F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

[0097] The HDD 904 stores programs executed by the CPU 901 and data used by the programs. The communication I / F 906 receives data from other devices via the communication network 920 and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network 920.

[0098] The media I / F 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to a target process from the recording medium 912 onto the RAM 903 via the media I / F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical Disk), a magnetic recording medium, or a semiconductor memory.

[0099] For example, when the computer 900 functions as the risk assessment units 60, 60B according to the above-described embodiments, the CPU 901 executes a program loaded onto the RAM 903 to realize the functions of the risk assessment units 60, 60B. The HDD 904 stores data stored in the RAM 903. The CPU 901 reads and executes a program related to a target process from a recording medium 912. Alternatively, the CPU 901 may read a program related to a target process from another device via a communication network 920.

[0100] [Effects] As described above, the security risk assessment device is characterized by comprising: a risk identification unit 61 that identifies security risks inherent in a network system and sources of external threats based on security information regarding information assets, vulnerabilities, and threats within a network system having multiple hosts, which is collected by multiple security devices installed in the network system; creates an analysis graph that describes the probabilistic dependencies of the identified security risks in the form of a directed acyclic graph; and adds nodes indicating the sources of the identified external threats to the analysis graph; a risk analysis unit 62 that calculates a risk probability regarding the state of the node using information about threats within the network detected by security software installed in a host in the network system and the analysis graph; and a risk evaluation unit 63 that estimates a loss cost when a risk becomes apparent based on the risk probability calculated by the risk analysis unit 62 and predetermined asset value information, and determines that the risk requires action if the estimated loss cost is equal to or exceeds a predetermined risk standard.

[0101] In this way, in the security risk assessment device 60, the risk identification unit 61 can specifically identify not only risks inherent in the network but also external threat sources (e.g., IP addresses, applications, and protocols used by attackers). The risk analysis unit 62 calculates risk probability using threat information within the network detected by security software installed on the host, thereby taking into account not only threat information near the network boundary but also threat information within the network. Furthermore, the risk evaluation unit 63 can automatically determine the acceptability of the risk based on estimated loss costs and risk criteria entered by a system administrator or the like. Furthermore, the security risk assessment device automates risk identification and risk analysis, making it easier for system administrators without advanced technical knowledge to perform risk assessments and minimizing the possibility of human error.

[0102] In the security risk assessment device, the nodes of the analysis graph are nodes that represent either a start port, an end port, or a vulnerability in a host, and the risk identification unit 61 includes a first process of describing the dependency relationships between the hosts by classifying a plurality of hosts in a network system into a plurality of host groups according to their distance from the outside based on the traffic volume as security information collected over a predetermined period and warnings against unauthorized communications, and a second ... dependency relationships between the hosts. a third process of calculating, within each host, the probability that a vulnerability will be accessed from the destination port and the vulnerability will be exploited as the weight of the edge between the nodes; a fourth process of calculating, within each host, the probability that unauthorized communication will be carried out from the source port after the vulnerability has been exploited as the weight of the edge between the nodes; a fifth process of setting state variables for each node based on the alert; and a sixth process of adding and setting nodes that indicate external malicious interfaces based on alerts for unauthorized communication as security information regarding external threats collected over a specified period.

[0103] By doing this, in the security risk assessment device 60, the risk identification unit 61 can calculate, as an edge weight, the probability that unauthorized communication from outside the network system will propagate from a start port to a destination port. The risk identification unit 61 can also calculate, as an edge weight, the probability that the propagation of unauthorized communication from outside will lead to a vulnerability attack. Furthermore, the risk identification unit 61 adds nodes indicating external malicious interfaces to the analysis graph, making it possible to identify and visualize the IP addresses and port numbers of hosts that have conducted malicious or suspected malicious communication.

[0104] In the security risk assessment device, the risk analysis unit 62 is characterized in that when it acquires detection information regarding abnormalities in a host collected over a specified period by security software installed on the host, it updates the state variable of the host's node in the analysis graph to a non-zero value and then calculates the risk probability.

[0105] In this way, the security risk assessment device 60 can perform an assessment that takes into account not only alert information related to interfaces that interface with external networks, but also alert information related to host behavior. Therefore, the security risk assessment device 60 can perform a more realistic assessment by taking into account not only threat information near the network boundary, but also threat information within the network.

[0106] In the security risk assessment device, when the risk assessment unit 63 determines that a risk requires a response, it identifies the source of the external threat that corresponds to the ancestor node of the risk in the analysis graph.

[0107] By doing this, in the security risk assessment device 60, the risk assessment unit 63 can not only identify risks inherent in the network that have been determined to require response, but also specifically identify the sources of external threats that are ancestor nodes of nodes in the analysis graph that indicate risks that have been determined to require response, thereby enabling a more realistic assessment.

[0108] In the security risk assessment device, the risk identification unit 61 acquires risks that have been determined to require response by the risk evaluation unit 63, and identifies the dependency relationships of nodes along the direction of the edge pointing outward, with the node indicating the risk in the analysis graph as the root node, thereby describing an outbound analysis graph and outputting the outbound analysis graph to the risk analysis unit 62.

[0109] In this way, the security risk assessment device 60B can input the results of the risk evaluation unit 63 to the risk identification unit 61 and the risk analysis unit 62, thereby achieving a more detailed risk assessment. The risk identification unit 61 describes not only the original analysis graph but also the outbound analysis graph, so that it can consider not only the attack phase in which an attacker infiltrates the network (inbound direction), but also the attack phase in which an attacker steals information (outbound direction). This allows for a more detailed risk assessment that is in line with reality. Furthermore, by tracking the outbound flow, the security risk assessment device 60B can identify the destination of data flowing out from an interface that is (highly likely to be) under attack, leading to rapid risk response operations such as packet filtering.

[0110] The security risk assessment method is a security risk assessment method of a security risk assessment device 60, in which the security risk assessment device 60 executes the following steps: identifying security risks inherent in a network system and sources of external threats based on security information regarding information assets, vulnerabilities, and threats within a network system having multiple hosts, each collected by multiple security devices installed in the network system; creating an analysis graph that describes the probabilistic dependencies of the identified security risks in the form of a directed acyclic graph; and adding nodes indicating the sources of the identified external threats to the analysis graph; calculating a risk probability regarding the state of the node using information about threats within the network detected by security software installed on each host in the network system and the analysis graph; and estimating the loss cost when the risk becomes apparent based on the risk probability and predetermined asset value information, and determining that the risk requires action if the estimated loss cost is equal to or exceeds a predetermined risk standard.

[0111] By doing so, in the security risk assessment method, the security risk assessment device 60 can specifically identify not only the risks inherent in the network but also the source of external threats. Furthermore, since the security risk assessment device 60 calculates the risk probability using threat information within the network detected by security software installed on the host, it can take into account not only threat information near the network boundary but also threat information within the network. Furthermore, the security risk assessment device 60 can automatically determine the acceptability of the risk based on the estimated loss cost and the risk criteria entered by the system administrator, etc. This allows for a realistic risk assessment.

[0112] The security risk assessment system comprises a network information acquisition unit 10 that automatically collects security information regarding information assets, vulnerabilities, and threats within a network system having multiple hosts, each collected by a plurality of security devices installed within the network system; a host abnormality detection unit 20 that acquires detection information regarding host abnormalities from security software installed on the hosts within the network system; a data processing unit 40 that associates the security information acquired by the network information acquisition unit 10 with the time the security information was collected and stores them in a database, and also associates the detection information acquired by the host abnormality detection unit 20 with the time the detection information was collected and stores them in a database; and a security risk assessment device 60, wherein the security risk assessment device 60 creates an analysis graph based on the data stored in the database 50.

[0113] By doing this, the database 50 can receive a specified period as a query from the risk identification unit 61 of the security risk assessment device 60 and provide the risk identification unit 61 with data regarding information assets, vulnerabilities, and threats for the specified period.

[0114] The present invention is not limited to the above-described embodiments, and many modifications can be made by a person skilled in the art within the technical concept of the present invention.

[0115] 1, 1B Security risk assessment system 10 Network information acquisition unit 11 Network flow information acquisition unit 12 Vulnerability information acquisition unit 13 Threat information acquisition unit 20 Host abnormality detection unit 30 Information input unit 40 Data processing unit 50 Database 60, 60B Risk assessment unit (security risk assessment device) 61 Risk identification unit 62 Risk analysis unit 63 Risk evaluation unit 70 Assessment result output unit

Claims

1. A security risk assessment device comprising: a risk identification unit that identifies security risks and external threat sources inherent in a network system having multiple hosts based on security information regarding information assets, vulnerabilities, and threats within the network system, each collected by a plurality of security devices installed in the network system, creates an analysis graph that describes the probabilistic dependencies of the identified security risks in the form of a directed acyclic graph, and adds a node indicating the source of the identified external threat to the analysis graph; a risk analysis unit that calculates a risk probability regarding the state of a node using internal network threat information detected by security software installed in a host in the network system and the analysis graph; and a risk evaluation unit that estimates a loss cost when a risk becomes apparent based on the risk probability calculated by the risk analysis unit and predetermined asset value information, and determines that the risk requires an action if the estimated loss cost is equal to or exceeds a predetermined risk standard.

2. The nodes of the analysis graph are nodes that represent either a start port, a destination port, or a vulnerability in a host, and the risk identification unit performs a first process of describing dependencies between hosts by classifying a plurality of hosts in the network system into a plurality of host groups according to their distance from the outside based on the traffic volume as security information collected during a predetermined period and an alarm against unauthorized communications; a second process of calculating, according to the dependencies between the hosts, the probability that unauthorized communications will flow between a start port of a host included in a predetermined host group and a destination port of a host included in another host group that depends on the predetermined host group, as the weight of the edge between the nodes; a third process of calculating, within each host, the probability that a vulnerability will be accessed from the destination port and the vulnerability will be exploited, as the weight of the edge between the nodes; a fourth process of calculating, within each host, the probability that unauthorized communications will be performed from the start port after the vulnerability has been exploited, as the weight of the edge between the nodes; and a fifth process of setting state variables for each node based on the alarm. The security risk assessment device of claim 1, further comprising: a sixth process of additionally setting a node indicating an external malicious interface based on an alert for unauthorized communication as security information regarding external threats collected over a specified period of time.

3. The security risk assessment device of claim 1, characterized in that when the risk analysis unit obtains detection information regarding an abnormality in the host collected over a specified period of time by security software installed on the host, it updates the state variable of the node of the host in the analysis graph to a non-zero value and then calculates the risk probability.

4. The security risk assessment device described in claim 1, characterized in that when the risk assessment unit determines that the risk requires response, it identifies the source of an external threat that corresponds to an ancestor node of the risk in the analysis graph.

5. The security risk assessment device of claim 1, characterized in that the risk identification unit obtains risks determined to require response by the risk evaluation unit, identifies node dependencies along the direction of edges heading outward with the node indicating the risk in the analysis graph as the root node, describes an outbound analysis graph, and outputs the outbound analysis graph to the risk analysis unit.

6. A security risk assessment method for a security risk assessment device, wherein the security risk assessment device executes the steps of: identifying security risks and external threat sources inherent in a network system having a plurality of hosts based on security information relating to information assets, vulnerabilities, and threats within the network system, each collected by a plurality of security devices installed in the network system, creating an analysis graph in which the probabilistic dependencies of the identified security risks are described in the form of a directed acyclic graph, and adding a node indicating the identified source of the external threat to the analysis graph; calculating a risk probability related to the state of the node using information on threats within the network detected by security software installed in each host in the network system and the analysis graph; and estimating a loss cost in the event that a risk becomes apparent based on the risk probability and predetermined asset value information, and determining that the risk requires an action if the estimated loss cost is equal to or exceeds a predetermined risk standard.

7. A security risk assessment system comprising: a network information acquisition unit that automatically collects security information relating to information assets, vulnerabilities, and threats within a network system having a plurality of hosts, each collected by a plurality of security devices installed in the network system; a host anomaly detection unit that acquires detection information relating to abnormalities in the hosts from security software installed in the hosts in the network system; a data processing unit that associates the security information acquired by the network information acquisition unit with the time the security information was collected and stores it in a database, and also associates the detection information acquired by the host anomaly detection unit with the time the detection information was collected and stores it in a database; and a security risk assessment device described in any one of claims 1 to 5, wherein the security risk assessment device creates the analysis graph based on the data stored in the database.

8. A program for causing a computer to function as a security risk assessment device according to any one of claims 1 to 5.

Images