Attack analysis device, attack analysis method, and attack analysis program

Abstract

An attack analysis device (100) comprises an analysis priority changing unit (130) that, when equipment to be analyzed that is provided in a system under attack comprising a plurality of equipment each having a set analysis priority is subjected to an attack in question, namely a cyberattack, changes the analysis priority corresponding to the equipment to be analyzed according to the details of the attack in question. Let a group of equipment under attack be defined as a plurality of equipment provided in a system under attack. When each piece of equipment included in the group of equipment under attack is subjected to a cyberattack, the respective cyberattacks on each piece of equipment included in the group of equipment under attack are analyzed sequentially according to the analysis priority corresponding to each piece of equipment included in the group of equipment under attack.

Description

Attack analysis device, attack analysis method, and attack analysis program

[0001] The present disclosure relates to an attack analysis device, an attack analysis method, and an attack analysis program.

[0002] A honeypot is a system that invites cyberattacks by exposing a terminal that has been intentionally set up to be vulnerable to attack on the Internet, and then observes and analyzes the cyberattacks that have been invited. Honeypots usually receive a large amount of attack traffic, so it takes time to analyze the received attack traffic. Attack traffic is traffic that indicates a cyberattack. On the other hand, when a cyberattack that has a significant impact on a product is observed, it is necessary to quickly analyze the observed cyberattack in order to immediately consider countermeasures.

[0003] Japanese Patent Application Laid-Open No. 2022-191649

[0004] A honeypot simulating a system continuously receives a large volume of cyberattack communications. Some cyberattacks consist of multiple stages, such as collecting information followed by a further cyberattack. Therefore, analyzing all cyberattacks in chronological order requires a lot of time and effort. Patent Literature 1 discloses a technology for calculating the priority of cyberattacks based on time-dependent and non-time-dependent parameters. However, this technology does not use analysis priorities that take into account the impact of cyberattacks on products, nor does it change the analysis priorities based on the content of the observed cyberattacks. Therefore, this technology has a drawback in that it is unable to prioritize the analysis of cyberattacks on devices with a high corresponding analysis priority. The present disclosure aims to enable the prioritized analysis of cyberattacks on devices with a high corresponding analysis priority by using analysis priorities that take into account the impact of cyberattacks on products and changing the analysis priorities based on the content of the observed cyberattacks.

[0005] The attack analysis device according to the present disclosure is an attack analysis device that includes an analysis priority change unit that changes the analysis priority corresponding to a target device in accordance with the content of a target attack when the target device, which is a device included in an attack target system having a plurality of devices each having an analysis priority set for it, is subjected to a cyber attack. When the plurality of devices included in the attack target system are considered as a group of attack target devices, and each device included in the group of attack target devices is subjected to a cyber attack, the cyber attacks against each device included in the group of attack target devices are analyzed in order according to the analysis priority corresponding to each device included in the group of attack target devices.

[0006] According to the present disclosure, the analysis priority change unit changes the analysis priority according to the content of the cyberattack. Here, the analysis priority may be prepared taking into consideration the impact of the cyberattack on the product. Therefore, according to the present disclosure, by using the analysis priority prepared taking into consideration the impact of the cyberattack on the product and changing the analysis priority according to the content of the observed cyberattack, it is possible to prioritize the analysis of cyberattacks on devices with a high corresponding analysis priority.

[0007] FIG. 1 is a diagram showing an example of the configuration of an attack analysis system 90 according to the first embodiment. FIG. 2 is a diagram explaining the processing of an analysis priority change unit 130 according to the first embodiment, where (a) shows Example 1 and (b) shows Example 2. FIG. 3 is a diagram showing an example of the hardware configuration of an attack analysis device 100 according to the first embodiment. A flowchart showing the processing of an asset information creation unit 120 according to the first embodiment. A diagram showing a specific example of data stored in an asset DB 191 according to the first embodiment. A diagram showing a specific example of data stored in a relationship information DB 192 according to the first embodiment. A flowchart showing the processing of an attack analysis system 90 according to the first embodiment. A diagram showing a specific example of data stored in an attack information DB 190 according to the first embodiment. A diagram explaining the processing of an analysis priority change unit 130 according to the first embodiment. A diagram showing an example of the hardware configuration of an attack analysis device 100 according to a modification of the first embodiment. A diagram showing an example of the configuration of an attack analysis system 90 according to a second embodiment. A diagram showing a specific example of data stored in an asset DB 191 according to the second embodiment. A diagram showing a specific example of data stored in a vulnerability information DB 193 according to the second embodiment. A flowchart showing the processing of an attack analysis system 90 according to the second embodiment. 10 is a diagram showing a specific example of data stored in the attack information DB 190 according to the second embodiment. FIG. 11 is a diagram explaining the processing of the analysis priority change unit 130 according to the second embodiment.

[0008] In the description of the embodiments and drawings, the same elements and corresponding elements are given the same reference numerals. The description of elements given the same reference numerals will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "part" may be read as "circuit," "step," "procedure," "processing," or "circuitry" as appropriate. In this specification, cyber-attacks may also be referred to simply as "attacks."

[0009] First Embodiment Hereinafter, the present embodiment will be described in detail with reference to the drawings.

[0010] *** Description of Configuration *** Figure 1 shows an example configuration of an attack analysis system 90 according to this embodiment. As shown in Figure 1, the attack analysis system 90 comprises an attack analysis device 100, a honeypot 200, and an external security agency 300. The elements of the attack analysis system 90 are connected to each other via a network so that they can communicate with each other.

[0011] The attack analysis system 90 uses a means for setting the priority of attack analysis according to the analysis priority corresponding to each device when an attack is observed in the honeypot 200. The attack analysis system 90 efficiently analyzes attacks consisting of multiple stages by changing the analysis priority corresponding to devices that are likely to be attacked in the future through attack analysis. As a specific example, consider a case where device 1 holds important information and therefore the analysis priority corresponding to device 1 is relatively high. In this case, if device 1 is attacked, the attack against device 1 is quickly analyzed. As another specific example, consider a case where device 2 does not hold particularly important information and therefore the analysis priority corresponding to device 2 is relatively low. In this case, if device 2 is attacked, the priority of attack countermeasures against device 2 is relatively low. As another specific example, if information about device 3 is leaked due to an attack, there is a possibility that a next attack will be carried out based on the leaked information. Therefore, in preparation for the next attack, the analysis priority corresponding to device 3 is relatively high.

[0012] As shown in FIG. 1 , the attack analysis device 100 includes an attack analysis unit 110, an asset information creation unit 120, and an analysis priority change unit 130. The attack analysis device 100 also stores an attack information database (DB) 190, an asset DB 191, and a relationship information DB 192. The honeypot 200 includes an attack detection unit 210 and each device. Each device included in the honeypot 200 may be an emulator of the device. The honeypot 200 corresponds to an attack target system. The honeypot 200 may also be a system corresponding to a product. The term "device" may be replaced with "terminal." The attack target system includes multiple devices, each of which has an analysis priority assigned to it. When each device included in a group of attack target devices is subjected to a cyber-attack, the cyber-attacks against each device included in the group of attack target devices are analyzed in order according to the analysis priority corresponding to each device included in the group of attack target devices. The group of attack target devices consists of multiple devices included in the attack target system. The attack analysis system 90 may include a system that is actually in operation as an attack target system instead of the honeypot 200. That is, this embodiment may be utilized as a technology used in a security analysis product for a system that is actually in operation.

[0013] The attack analysis unit 110 analyzes attacks against each device included in the honeypot 200 and stores data indicating the analysis results as attack information in the attack information DB 190. In this case, the attack analysis unit 110 analyzes, as a specific example, the origin of the attack and the type of attack against which terminal by analyzing communication logs. The attack analysis unit 110 may also analyze information stolen in the attack and abnormalities in each device caused by the attack.

[0014] The asset information creating unit 120 creates the asset DB 191 .

[0015] When a target device is subjected to a targeted attack, the analysis priority change unit 130 changes the analysis priority corresponding to the target device according to the nature of the targeted attack. The target device is a device included in the system targeted for attack. The targeted attack is a cyber attack. When a target device is subjected to a targeted attack, the analysis priority change unit 130 may change the analysis priority corresponding to the target device according to the importance of data stored in the target device. The analysis priority change unit 130 may change the analysis priority corresponding to each device among multiple devices included in the target system that is thought to be subject to an attack executed based on information stolen in the targeted attack. The stolen information is information that has been illegally accessed. As a specific example, the analysis priority change unit 130 appropriately references the attack information DB 190, the asset DB 191, and the relationship information DB 192 and changes the analysis priority corresponding to each device as needed. Because the number of attacks against the honeypot 200 is usually enormous, setting an analysis priority for each device narrows down the attacks to be analyzed. The number of devices with relatively high analysis priorities may be determined based on the amount of computing resources, the time available for analyzing attacks, etc.

[0016] The attack information DB 190 stores data indicating attack information. The asset DB 191 stores data indicating assets. As a specific example, assets consist of each device and the data stored in each device. The relationship information DB 192 stores data indicating relationship information. Relationship information is information related to assets.

[0017] The attack detection unit 210 detects attacks on each device included in the honeypot 200 and notifies the attack analysis device 100 of the detection results.

[0018] FIG. 2 is a diagram illustrating a specific example of the processing performed by the analysis priority change unit 130. Here, each client corresponds to a device, and each server corresponds to a device. Assume that before an attack on each device is detected, the analysis priority corresponding to each client is set to "low," and the analysis priority corresponding to each server is set to "medium." (a) of FIG. 2 illustrates a specific example in which account information for a service is leaked from client 1 due to an attack. In this example, the analysis priority change unit 130 determines that there is a high possibility of future unauthorized logins to server 1 because the service is running on server 1, and therefore increases the analysis priority corresponding to server 1. (b) of FIG. 2 illustrates a specific example in which address information (path information) for a file server is leaked from client 1 due to an attack. In this example, the analysis priority change unit 130 determines that there is a high possibility of future unauthorized logins to server 2 because the file server is running on server 2, and therefore increases the analysis priority corresponding to server 2. In addition, when document data is stolen, the analysis priority change unit 130 may determine that there will be no future attacks based on the stolen document data and may not need to change the analysis priority corresponding to each device.

[0019] 3 shows an example of the hardware configuration of the attack analysis device 100 according to this embodiment. The attack analysis device 100 is made up of a computer. The attack analysis device 100 may also be made up of multiple computers.

[0020] As shown in the figure, the attack analysis device 100 is a computer that includes hardware such as a processor 11, a memory 12, an auxiliary storage device 13, an input / output IF (Interface) 14, and a communication device 15. These pieces of hardware are connected as appropriate via signal lines 19.

[0021] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of a computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The attack analysis device 100 may include multiple processors that replace the processor 11. The multiple processors share the role of the processor 11.

[0022] The memory 12 is typically a volatile storage device, specifically a random access memory (RAM). The memory 12 is also called a primary storage device or a main memory. Data stored in the memory 12 is saved in the secondary storage device 13 as needed.

[0023] The auxiliary storage device 13 is typically a non-volatile storage device, and specific examples thereof include a ROM (Read Only Memory), an HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 13 is loaded into the memory 12 as needed. The memory 12 and the auxiliary storage device 13 may be configured integrally.

[0024] The input / output IF 14 is a port to which an input device and an output device are connected. Specific examples of the input / output IF 14 include a USB (Universal Serial Bus) terminal. Specific examples of the input device include a keyboard and a mouse. Specific examples of the output device include a display.

[0025] The communication device 15 is a receiver and a transmitter, and is specifically a communication chip or a NIC (Network Interface Card).

[0026] Each part of the attack analysis device 100 may use the input / output IF 14 and the communication device 15 as appropriate when communicating with other devices.

[0027] The auxiliary storage device 13 stores an attack analysis program. The attack analysis program is a program that causes a computer to realize the functions of each unit included in the attack analysis device 100. The attack analysis program is loaded into the memory 12 and executed by the processor 11. The functions of each unit included in the attack analysis device 100 are realized by software.

[0028] Data used when executing the attack analysis program and data obtained by executing the attack analysis program are stored in a storage device as appropriate. Each part of the attack analysis device 100 uses a storage device as appropriate. Specific examples of the storage device include at least one of the memory 12, the auxiliary storage device 13, a register in the processor 11, and a cache memory in the processor 11. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of the memory 12 and the auxiliary storage device 13 may be realized by other storage devices.

[0029] The attack analysis program may be recorded on a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The attack analysis program may be provided as a program product.

[0030] ***Explanation of Operation*** The operational procedure of the attack analysis device 100 corresponds to an attack analysis method. Also, the program that realizes the operation of the attack analysis device 100 corresponds to an attack analysis program.

[0031] 4 is a flowchart showing an example of the process performed by the asset information creating unit 120 in advance preparation. The process performed by the asset information creating unit 120 will be described with reference to FIG.

[0032] (Step S101) The asset information creation unit 120 creates an asset DB 191 and a relationship information DB 192. The asset information creation unit 120 may create multiple DBs for each DB depending on the type of information. FIG. 5 shows a specific example of data stored in the asset DB 191. In this example, the asset information includes information indicating each device, information indicating the configuration of each device, information indicating the data held by each device, and information indicating the analysis priority corresponding to each device. The asset information creation unit 120 stores the asset information in the asset DB 191. The asset information creation unit 120 also sets an analysis priority corresponding to each device and stores the set analysis priority in the asset DB 191. An analyst or the like may set the analysis priority. The analysis priority may be set taking into account the impact of a cyber-attack on a product. FIG. 6 shows a specific example of data stored in the relationship information DB 192. The relationship information DB 192_1 shows relationship information for account information. The relationship information DB 192_2 indicates relationship information related to the addresses of file servers. If data held by each device is also shared by other devices, the asset information creation unit 120 stores information indicating the shared data in the relationship information DB 192.

[0033] 7 is a flowchart showing an example of the processing of the attack analysis system 90 during operation. The processing of the attack analysis system 90 will be described with reference to FIG.

[0034] (Step S111 ) The attack detection unit 210 detects an attack on the honeypot 200 and transmits data indicating the detected attack to the attack analysis device 100 .

[0035] (Step S112) The attack analysis unit 110 receives data indicating attacks from the honeypot 200, analyzes the logs of each attack indicated in the received data, and identifies data that was unauthorizedly accessed by each attack. The attack analysis unit 110 then stores data indicating the identified data in the attack information DB 190. The attack analysis unit 110 then determines whether or not there is a possibility of future attacks based on the asset information stored in the asset DB 191, which corresponds to the destination of unauthorized access in each attack, and attack information from the external security agency 300. The attack analysis unit 110 stores data indicating the determination results in the attack information DB 190. FIG. 8 shows a specific example of data stored in the attack information DB 190. For each attack, the data indicates the attacked device, the unauthorized accessed data, and the possibility of future attacks. Note that the asset DB 191 may previously set whether or not there is a possibility of future attacks for each piece of information. As a specific example, the asset DB 191 sets information indicating the possibility of future attacks for information indicating an account. At this time, if there is unauthorized access to the information indicating the account, the attack analysis unit 110 determines that there is a possibility of future attacks on the device corresponding to the information indicating the account.

[0036] (Step S113) If there is an attack that is set as a possible future attack in the attack information DB 190, step S114 is executed next. Otherwise, step S116 is executed next.

[0037] (Step S114) The analysis priority change unit 130 extracts from the relationship information DB 192 other devices that share data that has been illegally accessed by an attack that is set in the attack information DB 190 as having a future possibility of attack. In FIG. 8 , the attacks that are set in the attack information DB 190 as having a future possibility of attack are unauthorized access to account information for service X and unauthorized access to address information for server 2. As a specific example, the account information for service X of client 1 shown in FIG. 8 is data used in server 1 as shown in relationship information DB 192_1. Therefore, the analysis priority change unit 130 determines that server 1 is likely to be attacked in the future. As another specific example, the address information of server 2 shown in FIG. 8 is data used to access a file server in server 2 as shown in relationship information DB 192_2. Therefore, the analysis priority change unit 130 determines that server 2 is likely to be attacked in the future.

[0038] (Step S115) The analysis priority change unit 130 appropriately changes the analysis priority corresponding to each attacked device that is set in the attack information DB 190 as having a possibility of future attacks, and the analysis priority corresponding to each device extracted from the relationship information DB 192 in step S114. FIG. 9 is a diagram corresponding to FIGS. 5, 6, and 8, and illustrates a specific example of the process of changing the analysis priority. As a specific example, client 1 corresponds to an attacked device that is set in the attack information DB 190 as having a possibility of future attacks. Therefore, the analysis priority change unit 130 increases the analysis priority corresponding to client 1. Furthermore, server 1 operates service X, which uses account information leaked in the attack on client 1. Therefore, the analysis priority change unit 130 increases the analysis priority corresponding to server 1. As another specific example, the analysis priority change unit 130 increases the analysis priority corresponding to client 1 that has been subjected to unauthorized access, and the analysis priority corresponding to server 2 that can be accessed using address information leaked in the attack on client 1.

[0039] (Step S116) If the attack analysis system 90 continues to monitor attacks, step S111 is executed again. Otherwise, the attack analysis system 90 ends the processing of this flowchart. The analysis priority change unit 130 may change the analysis priority as necessary. As a specific example, if the risk of a future attack on a certain device is reduced by applying a countermeasure to the device, the analysis priority change unit 130 changes the analysis priority corresponding to the device to its original value.

[0040] ***Description of Effects of First Embodiment*** According to this embodiment, it is possible to use analysis priorities set according to asset contents and to change the analysis priorities according to the attack contents. Setting an analysis priority corresponding to each device that is the target of attack analysis can improve the efficiency of attack analysis. Changing the analysis priority according to the attack contents allows prioritizing analysis and countermeasures according to the attack situation. By utilizing this embodiment, attacks against devices with relatively high analysis priorities can be prioritized for analysis among multiple observed attacks. Furthermore, according to this embodiment, when a device that is likely to be targeted in future attacks is identified based on the observed attacks, the analysis priority corresponding to the likely targeted device can be changed. Therefore, according to this embodiment, it is possible to respond to attacks consisting of multiple stages, such as using one attack as a foothold to launch another attack. As a specific example, in the case of a multi-stage attack, such as "collecting information and then launching a further attack," by increasing the analysis priority corresponding to a device that is likely to be targeted in the next stage of the attack when information collection is detected, the attack against that device can be quickly analyzed when the next stage of the attack occurs.

[0041] ***Other Configurations*** <Variation 1> Fig. 10 shows an example hardware configuration of an attack analysis device 100 according to this variation. The attack analysis device 100 includes a processing circuit 18 instead of the processor 11, the processor 11 and memory 12, the processor 11 and auxiliary storage device 13, or the processor 11, memory 12, and auxiliary storage device 13. The processing circuit 18 is hardware that realizes at least a portion of the components included in the attack analysis device 100. The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the memory 12.

[0042] When the processing circuitry 18 is dedicated hardware, the processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The attack analysis device 100 may include multiple processing circuits that replace the processing circuitry 18. The multiple processing circuits share the role of the processing circuitry 18.

[0043] In the attack analysis device 100, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0044] The processing circuitry 18 is realized by, for example, hardware, software, firmware, or a combination of these. The processor 11, memory 12, auxiliary storage device 13, and processing circuitry 18 are collectively referred to as "processing circuitry." In other words, the functions of each functional component of the attack analysis device 100 are realized by the processing circuitry. Attack analysis devices 100 according to other embodiments may also have a configuration similar to this modification.

[0045] Second Embodiment The following mainly describes the differences from the above-described embodiment with reference to the drawings.

[0046] *** Description of Configuration *** FIG. 11 shows an example of the configuration of an attack analysis system 90 according to this embodiment. The attack analysis device 100 according to this embodiment further stores a vulnerability information DB 193 as shown in FIG. 11. The attack analysis device 100 may also store a relationship information DB 192. The attack analysis device 100 according to this embodiment has a function of changing the analysis priority of other devices that have the same vulnerability when a device in the honeypot 200 is attacked by exploiting a vulnerability. As a specific example, when an attack exploiting a vulnerability in software a installed on client 1 is detected, the analysis priority corresponding to client 2, which also has the same software a installed, is determined to be highly likely to be attacked in the future, and the analysis priority corresponding to client 2 is increased.

[0047] When a targeted attack is caused by a targeted vulnerability, the analysis priority change unit 130 according to this embodiment changes the analysis priority corresponding to each device that has a targeted vulnerability other than the target device among multiple devices included in the attacked system. The target vulnerability is a vulnerability that the target device has.

[0048] The vulnerability information DB 193 stores information indicating vulnerabilities of devices, software, and the like.

[0049] ***Explanation of Operation*** The following describes the differences from the first embodiment in the processing of the asset information creating unit 120 in advance preparation.

[0050] (Step S101) The asset information creation unit 120 executes the following process in addition to the process of step S101 according to the first embodiment. In addition to asset information, the asset information creation unit 120 stores information indicating the versions of each FW (firmware) and each SW (software) installed in each device in the asset DB 191. FIG. 12 shows a specific example of data stored in the asset DB 191. Furthermore, the asset information creation unit 120 creates a vulnerability information DB 193 based on information from the external security agency 300. FIG. 13 shows a specific example of data stored in the vulnerability information DB 193. The data indicates vulnerabilities for each version of FW and SW installed in each device.

[0051] Fig. 14 is a flowchart showing an example of the processing of the attack analysis system 90 during operation. The processing of the attack analysis system 90 will be described using Fig. 14. Note that the attack analysis system 90 may execute the following processing in addition to the processing of the attack analysis system 90 according to the first embodiment.

[0052] (Step S212) The attack analysis unit 110 receives data indicating attacks from the honeypot 200, identifies data that was unauthorizedly accessed by each attack by analyzing the log of each attack indicated in the received data, and stores data indicating the identified data in the attack information DB 190. The attack analysis unit 110 then determines the vulnerability exploited in each attack based on the asset information stored in the asset DB 191 that corresponds to the destination of unauthorized access in each attack, and attack information from the external security agency 300, etc. The attack analysis unit 110 stores data indicating the determination results in the attack information DB 190. FIG. 15 shows a specific example of data stored in the attack information DB 190.

[0053] (Step S213) The analysis priority change unit 130 refers to the attack information DB 190 and the vulnerability information DB 193 and determines whether the vulnerability determined by the attack analysis unit 110 also exists in other devices. If it is determined that the vulnerability also exists in other devices, step S214 is executed next. Otherwise, step S116 is executed next.

[0054] (Step S214) The analysis priority change unit 130 refers to the attack information DB 190 and the vulnerability information DB 193, and extracts other devices that have vulnerabilities determined by the attack analysis unit 110 as related devices. As a specific example, as shown in Figures 13 and 15, software a installed on client 1 has been illegally accessed by exploiting a vulnerability. Furthermore, software a of the same version as the software a installed on client 1 is installed on client 2. Therefore, the analysis priority change unit 130 determines that client 2 may be subject to an attack similar to the attack on client 1 in the future, and extracts client 2 as a related device.

[0055] (Step S215) The analysis priority change unit 130 appropriately changes the analysis priority corresponding to each related device extracted in step S214. Figure 16 is a diagram corresponding to Figures 12, 13, and 15, and is a diagram illustrating a specific example of processing for changing the analysis priority. In this example, the analysis priority change unit 130 increases the analysis priority corresponding to client 1 that has been unauthorizedly accessed, and the analysis priority corresponding to client 2 that has a vulnerability similar to that of client 1 that has been unauthorizedly accessed.

[0056] ***Explanation of the effect of embodiment 2*** According to this embodiment, the analysis priority corresponding to each device that has the same vulnerability as the target device that has been attacked can be increased before an attack on each device is observed.

[0057] ***Other Embodiments*** The above-described embodiments can be freely combined, or any of the components of each embodiment can be modified, or any of the components can be omitted from each embodiment. Furthermore, the embodiments are not limited to those shown in embodiments 1 and 2, and various modifications are possible as needed. The procedures described using flowcharts, etc., can be modified as appropriate.

[0058] 11 Processor, 12 Memory, 13 Auxiliary storage device, 14 Input / output IF, 15 Communication device, 18 Processing circuit, 19 Signal line, 90 Attack analysis system, 100 Attack analysis device, 110 Attack analysis unit, 120 Asset information creation unit, 130 Analysis priority change unit, 190 Attack information DB, 191 Asset DB, 192 Relationship information DB, 193 Vulnerability information DB, 200 Honeypot, 210 Attack detection unit, 300 External security agency.

Claims

1. An attack analysis device comprising an analysis priority change unit that changes the analysis priority corresponding to a target device in accordance with the content of a target attack when the target device, which is a device included in an attack target system having multiple devices each having an analysis priority set for each device, is subjected to a cyber attack, wherein when the multiple devices included in the attack target system are considered as an attack target device group, when each device included in the attack target device group is subjected to a cyber attack, the cyber attacks against each device included in the attack target device group are analyzed in order according to the analysis priority corresponding to each device included in the attack target device group.

2. An attack analysis device as described in claim 1, wherein the analysis priority change unit changes the analysis priority corresponding to the target device according to the importance of data stored in the target device when the target device is subjected to the target attack.

3. An attack analysis device as described in claim 1 or 2, wherein the analysis priority change unit changes the analysis priority corresponding to each device among multiple devices equipped in the target system that is thought to be subject to an attack carried out based on information stolen in the target attack.

4. An attack analysis device as described in any one of claims 1 to 3, wherein the analysis priority change unit changes the analysis priority corresponding to each device other than the target device that has the target vulnerability among multiple devices included in the attack target system when the target attack is caused by a target vulnerability that is a vulnerability possessed by the target device.

5. The attack analysis device according to any one of claims 1 to 4, wherein the target system is a honeypot.

6. An attack analysis method in which, when a target device, which is a device included in an attack target system having multiple devices each having an analysis priority set for it, is attacked by a cyber attack, the computer changes the analysis priority corresponding to the target device according to the content of the target attack, wherein, when the multiple devices included in the attack target system are treated as an attack target device group, when each device included in the attack target device group is attacked by a cyber attack, the cyber attacks against each device included in the attack target device group are analyzed in order according to the analysis priority corresponding to each device included in the attack target device group.

7. An attack analysis program that causes an attack analysis device, which is a computer, to execute an analysis priority change process that changes the analysis priority corresponding to a target device according to the content of a target attack when a target device, which is a device included in an attack target system having multiple devices each having an analysis priority set for each device, is subjected to a cyber attack, wherein when the multiple devices included in the attack target system are considered as an attack target device group, when each device included in the attack target device group is subjected to a cyber attack, the cyber attacks against each device included in the attack target device group are analyzed in order according to the analysis priority corresponding to each device included in the attack target device group.

Images