Security function selection device, program, and security function selection method

Abstract

A security function selection device (100) comprises: a storage unit (120) for storing an attack tactic database (140) that stores attack tactics which are sequentially carried out in a cyberattack against a network function infrastructure and at least one attack method which is included in each of said attack tactics, and a security function database (150) that stores a detection function which is for detecting an attack by the attack method and a countermeasure function which is a countermeasure against the attack by the attack method; an information collection unit (112) for collecting attack information concerning the attack detected by the detection function; and a function selection unit (114) for selecting, with reference to the attack tactic database, a detection function and a countermeasure function that correspond to an attack method of an attack tactic carried out after the attack tactic for the attack method that corresponds to the detection function which has detected the collected attack information.

Description

Security function selection device, program, and security function selection method

[0001] The present invention relates to a security function selection device, a program, and a security function selection method for selecting security functions that protect a network function infrastructure.

[0002] In recent years, attention has been focused on virtual network infrastructure, which builds network systems using general-purpose servers and server virtualization technology. By introducing virtual network infrastructure, telecommunications carriers not only no longer need to procure dedicated hardware, but also become able to flexibly deploy, move, and delete various virtual network functions through software control. This is expected to result in significant reductions in equipment and operational costs.

[0003] In addition to packet forwarding and load balancing, virtual network functions also include security-related functions such as monitoring and countermeasures for anomalies and threats. Here, we refer to security-related virtual network functions as security functions. Security functions are essential, especially for virtual network infrastructures where multiple tenants share a single virtualized system. For example, each virtual network function is required to constantly monitor for suspicious behavior, detect and notify of anomalies, and take countermeasures against threats.

[0004] Such security functions include technologies described in Non-Patent Documents 1 and 2. Non-Patent Document 1 describes a technology that monitors the behavior of processes, files, system calls, etc. on a host OS, detects abnormalities and threats, and issues warnings. Non-Patent Document 2 describes a method for optimally arranging virtual network functions and virtual security functions in a virtual network infrastructure.

[0005] The Falco Project, [online], [Retrieved December 4, 2023], Internet <URL: https: / / falco.org / docs / > I. Tamim, et al., "Introducing Virtual Security Functions into Latency-aware Placement for NFV Applications," 2020 IEEE International Conference on Communications (ICC), 2020, pp. 1-7.

[0006] The technology described in Non-Patent Document 1 implements processes for monitoring, detecting, and responding to a wide variety of threats as one huge security function, making it impossible to extract only the necessary and sufficient security functions. Therefore, when this technology is used on a virtual network infrastructure, there is a risk that unnecessary processing will occur, resulting in communication delays. While the technology described in Non-Patent Document 2 makes it possible to optimally allocate given security functions, it is not possible to identify the necessary and sufficient security functions. Therefore, even if existing security functions are optimally allocated, there remains a risk that unnecessary processing will occur.

[0007] Virtual network infrastructures tend to have longer processing times and communication delays than systems using dedicated hardware. This makes it difficult to implement existing security functions in systems with strict real-time requirements, such as carrier networks. Security functions that minimize unnecessary processing are desired not only for virtual network infrastructures, but also for application operating environments that do not use virtual machines, containers, or virtualization technology, making it necessary to limit the security functions that are in operation.

[0008] The present invention has been made in view of the above background, and aims to select security functions that protect a network function infrastructure from among security functions related to a wide variety of threats.

[0009] In order to solve the above-mentioned problems, the security function selection device of the present invention comprises: a memory unit that stores an attack tactic database that stores attack tactics that are executed in sequence in a cyber-attack against a network function infrastructure and one or more attack methods included in each of the attack tactics, and a security function database that stores detection functions that detect attacks using the attack methods and countermeasure functions that are countermeasures against attacks using the attack methods; an information collection unit that collects attack information related to attacks detected by the detection functions; and a function selection unit that refers to the attack tactic database and selects detection functions and countermeasure functions that correspond to attack methods of attack tactics that are executed after the attack tactics of the attack method that corresponds to the detection function that detected the collected attack information.

[0010] According to the present invention, it is possible to select a security function that protects a network function infrastructure from among security functions related to a wide variety of threats.

[0011] Fig. 1 is a functional block diagram of a security function selection device according to the present embodiment. Fig. 2 is a data configuration diagram of an attack tactics database according to the present embodiment. Fig. 3 is a data configuration diagram of a security function database according to the present embodiment. Fig. 4 is a flowchart of security function selection processing according to the present embodiment. Fig. 5 is a data configuration diagram of an attack tactics database according to a modified example of the present embodiment. Fig. 6 is a flowchart of security function selection processing in an emergency according to a modified example of the present embodiment. Fig. 7 is a functional block diagram of a security function selection device according to a modified example of the present embodiment. Fig. 8 is a hardware configuration diagram showing an example of a computer that realizes the functions of the security function selection device according to the present embodiment.

[0012] <<Overview of the Security Function Selection Device>> A security function selection device in a mode (embodiment) for carrying out the present invention will be described below. The security function selection device protects a network function infrastructure from cyber-attacks. Here, the network function infrastructure refers to network functions and physical or virtual computing resources for realizing the network functions. Examples of network functions include functions provided by various web servers, load balancing functions, and security functions. Cyber-attacks against network functions include, for example, theft or tampering of data stored in a web server. Cyber-attacks against computing resources include, for example, DoS attacks against network bandwidth or web server resources.

[0013] The security function selection device protects, for example, the functions (services) of a web server operating on the device as a network function infrastructure from cyberattacks. In other words, the security function selection function operates on a server device that provides the functions of the web server as a network function infrastructure. Here, the server device may be a large-scale device configured with multiple server devices and other computing resources such as accelerators. Note that part of the security function selection function may operate on a separate device. The server device (security function selection device) is not limited to a hardware server device, but may also be a virtual machine or container on a virtualization infrastructure including a virtual network infrastructure.

[0014] The security function selection device selects security functions according to the cyber-attack situation to protect the network function infrastructure. In more detail, a cyber-attack is composed of multiple tactics, and once the tactical goal is achieved, the next tactical method is executed to achieve the final goal. When the security function selection device detects an attack using a tactical method, it selects and activates security functions corresponding to the subsequent tactical method.

[0015] This security function selection device reduces the processing costs of security functions compared to the conventional method of operating one huge security function that responds to a wide variety of threats. As a result, it is possible to provide a secure network function infrastructure with low processing costs. It also makes it possible to implement security measures suitable for systems with strict real-time requirements.

[0016] <Configuration of Security Function Selection Device> Fig. 1 is a functional block diagram of a security function selection device 100 according to this embodiment. The security function selection device 100 is a computer, and comprises a control unit 110, a storage unit 120, and a communication unit 180. The communication unit 180 comprises a communication device, and is capable of transmitting and receiving data to and from other devices, such as terminals that use the network function infrastructure.

[0017] <<Security Function Selection Device: Storage Unit>> The storage unit 120 is configured to include storage devices such as a ROM (Read Only Memory), a RAM (Random Access Memory), an SSD (Solid State Drive), etc. The storage unit 120 stores application data 130, an application program 131, an attack tactics database 140, a security function database 150, a detection information database 160, peacetime security functions 121, emergency security functions 122, and a program 123.

[0018] The application data 130 is data accessed by a server (application process, application function unit 111, described later) that provides network functions as a network function infrastructure running on the security function selection device 100. The application program 131 includes a description of the server's processing. The program 123 includes a description of the processing of a function unit provided in the control unit 110, described later. For example, the program 123 includes a description of the security function selection process (see FIG. 4, described later).

[0019] <Storage Unit: Attack Tactics Database> Figure 2 is a data structure diagram of the attack tactics database 140 according to this embodiment. A cyberattack achieves its final goal by sequentially executing multiple tactics, such as Tactics 1, Tactics 2, and so on. Each tactic includes one or more techniques, and the goal of the tactic is achieved by executing one or more of the techniques. The attack tactics database 140 is a database that lists a series of tactics and the techniques included in each tactic. For example, an attacker might attack a network function infrastructure by executing Technique 1A, followed by Techniques 2A and 2C, and then Technique 3D. Note that tactics are also referred to as attack tactics, and techniques are also referred to as attack techniques. Note that one example of the attack tactics database 140 is the MITRE ATT&CK ([online], [searched December 4, 2023], Internet <URL: https: / / attack.mitre.org / >).

[0020] 3 is a data configuration diagram of the security function database 150 according to this embodiment. The security function database 150 is, for example, data in a table format, and indicates, for each attack method, a detection function, which is a security function that detects the attack method (an attack using the attack method), and a countermeasure function, which is a security function that acts as a countermeasure against the attack method.

[0021] The detection function is, for example, a function of monitoring a specific configuration file to check whether it has been updated. The countermeasure function is, for example, a function of forcibly terminating a specific process. Note that programs that realize the detection function and the countermeasure function are included in the program 123 as modules.

[0022] It is desirable to implement security functions separately for each attack method. However, multiple security functions may be prepared for one attack method. Conversely, one security function may be compatible with multiple attack methods. Furthermore, depending on the attack method, a security function may not be possible. An example of a means of implementing security functions is the Extended Berkley Packet Filter (eBPF) ([online], [searched December 4, 2023], Internet <URL: https: / / ebpf.io / >).

[0023] <Storage Unit: Detection Information Database> Returning to Figure 1, the description of the storage unit 120 will continue. Information (detection information) on attacks detected by the detection functions (see Figure 3) is recorded in the detection information database 160 along with the time. Depending on which detection function detected the attack, it is possible to determine which method and tactic was used. Note that if one security function supports multiple attack methods, the attack method and tactics can be determined based on the content of the detection information (contents of the attack).

[0024] <Storage Unit: Peacetime Security Function> The peacetime security function 121 indicates the detection function and countermeasure function in the initial stage. The initial stage is the initial stage of the network function platform, or the initial stage of its startup, which is the period before a cyber-attack begins. During this period, no detection information is recorded in the detection information database 160, and it is considered to be peacetime when no attacks are occurring.

[0025] The normal time security functions 121 include security functions (detection functions and countermeasure functions) related to tactics with relatively low numbers. For example, the normal time security functions 121 include security functions related to tactics 1, tactics 2, and tactics 3. The method for selecting the normal time security functions 121 will be described later with reference to FIG. 4 (security function selection process).

[0026] In the MITRE ATT&CK described as an example of the attack tactics database 140, it is often difficult to detect or take measures against techniques such as tactics 1 and 2. In such cases, the peacetime security function 121 may include security functions related to tactics 3, 4, and 5, for example.

[0027] <Storage Unit: Emergency Security Functions> The emergency security functions 122 indicate detection functions and countermeasure functions after an attack is detected. For an attack detected by a detection function indicated in the operating normal security functions 121, the detection functions and countermeasure functions corresponding to attacks (attack methods) following the attack are included in the emergency security functions 122. If no attack is detected, the emergency security functions 122 are empty.

[0028] For example, suppose a detection function corresponding to technique 3A (see FIG. 2) detects an attack. This means that the attack has progressed to tactic 3, and it is predicted that the attack will then progress to tactic 4, tactic 5, and so on. In line with this prediction, the emergency security function 122 includes security functions for tactic 4, tactic 5, and tactic 6, which are the three tactics from tactic 3 onwards. The method for selecting the emergency security function 122 will be explained later using FIG. 4 (security function selection process).

[0029] <<Security Function Selection Device: Control Unit>> The control unit 110 is configured to include a CPU (Central Processing Unit), and is provided with an application function unit 111, an information collection unit 112, a countermeasure unit 113, a function selection unit 114, and a function control unit 115. The application function unit 111 accesses application data 130 and provides a network function infrastructure (network function).

[0030] <<Control Unit: Information Collection Unit>> The information collection unit 112 detects attacks against the network function infrastructure by using (operating) a detection function included in the peacetime security function 121 or the emergency security function 122. The information collection unit 112 records the detected attack as detection information in the detection information database 160. The information collection unit 112 also deletes detection information related to attacks for which countermeasures have been taken by the countermeasure unit 113, which will be described later. The information collection unit 112 may delete the detection information in accordance with instructions from the administrator of the security function selection device 100, or may delete the detection information after a predetermined time has passed since it was recorded.

[0031] <<Control Unit: Countermeasure Unit>> The countermeasure unit 113 uses (operates) countermeasure functions included in the peacetime security function 121 or the emergency security function 122 to take measures against attacks on the network function infrastructure.

[0032] <<Controller: Function Selector>> The function selector 114 selects security functions that are operational during normal times from the security function database 150 (see FIG. 3 ) and stores them in the normal time security functions 121. The function selector 114 also selects security functions that are operational after an attack is detected (after detection information is recorded in the detection information database 160) from the security function database 150 and stores them in the emergency security functions 122. The security function selection process in which the function selector 114 selects security functions will be described later with reference to FIG. 4 .

[0033] When the attack tactics database 140 or the security function database 150 is updated, the function selection unit 114 updates the peacetime security function 121 and notifies the function control unit 115, which will be described later, of the update. When detection information is recorded in the detection information database 160, the function selection unit 114 creates a temporary emergency security function 122. If this temporary emergency security function 122 differs from the current emergency security function 122, the function selection unit 114 replaces (updates) the current emergency security function 122 with the temporary emergency security function 122 and notifies the function control unit 115 of the update.

[0034] <<Control Unit: Function Control Unit>> The function control unit 115 instructs the information collection unit 112 to detect an attack using a detection function included in the peacetime security function 121 and the emergency security function 122. The function control unit 115 also instructs the countermeasure unit 113 to take measures against the attack using a countermeasure function included in the peacetime security function 121 and the emergency security function 122.

[0035] More specifically, if emergency security function 122 is empty, function control unit 115 instructs information collection unit 112 and countermeasure unit 113 to activate the security functions in peacetime security function 121. If emergency security function 122 is not empty, function control unit 115 instructs information collection unit 112 and countermeasure unit 113 to activate the security functions in emergency security function 122.

[0036] When function selection unit 114 updates normal security function 121 or emergency security function 122, it notifies function control unit 115. Upon receiving the notification, function control unit 115 instructs information collection unit 112 and countermeasure unit 113 to switch the security function in operation.

[0037] <<Security Function Selection Process (Normal Times)>> Figure 4 is a flowchart of the security function selection process according to this embodiment. First, the process for selecting security functions during normal times will be described. This process is executed, for example, when the attack tactics database 140 or the security function database 150 is updated. This process may also be executed at the command of the administrator of the security function selection device 100, or may be executed periodically.

[0038] In step S11, the function selection unit 114 acquires the corresponding tactics. The tactics that are associated with the security function selection process in peacetime are tactics with relatively low numbers, such as tactics 3, 4, and 5. In step S12, the function selection unit 114 refers to the attack tactics database 140 (see FIG. 2 ) to acquire the techniques included in the tactics acquired in step S11.

[0039] In step S13, the function selection unit 114 refers to the security function database 150 (see FIG. 3) to acquire the detection functions and countermeasure functions for the technique acquired in step S12. Hereinafter, the processing from step S14 onward is executed for each of the detection functions and countermeasure functions. In the following explanation, the detection functions and countermeasure functions will be simply referred to as functions.

[0040] In step S14, the function selection unit 114 sorts the functions in descending order of coverage to create a list of functions. Coverage refers to the number of techniques obtained in step S12 that one function covers (corresponds to). In Figure 3, detection function 1 covers technique 1A, detection function 3 covers technique 1C and technique 1E, and countermeasure function 4 covers technique 1C, technique 1D, and technique 1E. Therefore, the coverages of detection function 1, detection function 3, and detection function 4 are 1, 2, and 3, respectively.

[0041] In step S15, function selection unit 114 starts the process of repeating steps S16 to S17 in order for the functions in the list created in step S14. Hereinafter, the function that is the target of this repeated process will be referred to as the "processing target function." In step S16, function selection unit 114 starts the process of repeating step S17 in order, starting with the function next to the processing target function in the list. Hereinafter, the function that is the target of this repeated process will be referred to as the "next processing target function."

[0042] In step S17, if the methods covered by the function to be processed (corresponding to the function) include all the methods covered by the next function to be processed, the function selection unit 114 deletes the next function to be processed from the list. After the above processing is completed, the functions remaining on the list become the normal security functions 121.

[0043] <Security Function Selection Process (Emergency)> Next, the process for selecting security functions in an emergency will be described with reference to Figure 4. This process is executed, for example, when new detection information is recorded in the detection information database 160. This process may be executed at the instruction of the administrator of the security function selection device 100, or may be executed periodically. An emergency is when the network function infrastructure is under attack and detection information is recorded in the detection information database 160. Below, the differences between the security function selection process in an emergency and the security function selection process in peacetime (see Figure 4) will be described.

[0044] In step S11, the function selection unit 114 acquires the corresponding tactics. The corresponding tactics in the security function selection process in an emergency are a predetermined number of tactics following the tactic corresponding to the detection function that detected the attack related to the detection information recorded in the detection information database 160. If the predetermined number is 3 and the detection function corresponding to technique 3A detects the attack, the corresponding tactics are tactics 4, tactics 5, and tactics 6.

[0045] Steps S12 and onward are the same as the security function selection process in normal times. When the process is complete, the functions remaining on the list become the emergency security functions 122. If there is no detection information in the detection information database 160 in step S11, it is normal times, and the emergency security functions 122 are empty.

[0046] In this way, the function selection unit 114 selects security functions (detection functions and countermeasure functions) corresponding to the attack method of the attack tactic executed after the attack tactic of the detected attack method.

[0047] <Features of the Security Function Selection Device> The security function selection device 100 protects the network function infrastructure by switching (selecting) security functions according to the status of a cyber-attack. In peacetime, the security function selection device 100 selects and operates security functions related to tactics with relatively low numbers in the early stages of an attack to detect and take measures against the attack. As the attack progresses and the tactics to which the attack method belongs advance (the numbers increase), the security function selection device 100 selects and operates security functions related to the earlier tactics (numbers higher by a predetermined number) to detect and take measures against the attack.

[0048] With this security function selection device 100, only the security functions necessary and sufficient for a cyber-attack situation are in operation, compared to the conventional system where one huge security function is operated to deal with a wide variety of threats. This reduces the processing costs of the security functions, making it possible to provide a secure network function infrastructure with low processing costs. This in turn makes it possible to implement security measures suitable for systems with strict real-time requirements.

[0049] <<Modification: Relationship Between Attack Techniques>> In the above-described embodiment, the security functions that are activated are tactical units, and the security function selection device 100 activates security functions related to all attack techniques included in the tactics. Alternatively, in a modification, the security function selection device 100A (not shown) may activate security functions that correspond to the attack techniques of the next tactic that is related to the detected attack technique.

[0050] 5 is a data structure diagram of an offensive tactics database 140A according to a modified example of this embodiment. The arrows between attack techniques indicate the relationship between related or consecutive attack techniques. For example, this indicates that technique 1A is likely to be followed by technique 2A, which in turn is likely to progress to technique 3A or technique 3B.

[0051] FIG. 6 is a flowchart of security function selection processing in an emergency according to a modified example of this embodiment. In step S21, the function selection unit 114 acquires attack techniques included in the tactics a predetermined number of steps ahead related to the detected attack technique. Let us assume that the predetermined number is 2 and technique 1D (see FIG. 5) is detected. Since technique 1D is an attack technique of tactic 1, the function selection unit 114 acquires the attack techniques of tactic 2 and tactic 3 that follow technique 1D. More specifically, the function selection unit 114 acquires technique 2D as the attack technique of tactic 2 that follows technique 1D. Next, the function selection unit 114 acquires technique 3D and technique 3E as the attack techniques of tactic 3 that follow technique 2D. Steps S22 and onward are the same as steps S13 and onward described in FIG. 4 .

[0052] In this way, the function selection unit 114 selects security functions (detection functions and countermeasure functions) corresponding to attack methods including the next attack method following the detected attack method.

[0053] The security function selection device 100A operates security functions that are limited to attack methods that are related to (and executed subsequently to) a detected attack (attack method).This reduces the processing costs of security functions compared to the security function selection device 100, and makes it possible to implement security measures that are suitable for systems with stricter real-time requirements.

[0054] <<Modification: Security function selection device different from server device>> In the above embodiment, the network function (application function unit 111) as a network function platform runs on the security function selection device 100. In contrast, the device equipped with the network function platform and the security function selection device may be different devices. Also, the security function selection device may be installed on a large-scale network function platform configured from multiple server devices and other computational resources. In this case, the security function selection device is not limited to a physical server device, and may be realized as a virtual machine or container running on the network function platform.

[0055] 7 is a functional block diagram of a security function selection device 100B according to a modified example of this embodiment. The security function selection device 100B selects security functions that protect the network function infrastructure (application function unit 111) running on the server device 200. Note that the server device 200 may be configured from multiple server devices and other computing resources.

[0056] The information collection unit 112C of the server device 200 activates the detection functions included in the security functions sent by the security function selection device 100B and sends information about the detected attack to the security function selection device 100B. The countermeasure unit 113C activates the countermeasure functions included in the security functions sent by the security function selection device 100B and takes measures against the attack. The information collection unit 112B of the security function selection device 100B collects information about the attack (detection information) sent by the server device 200 and records it in the detection information database 160. The function selection unit 114 selects security functions that respond to the attack based on the detection information recorded in the detection information database 160, generates emergency security functions 122 (see FIG. 4 ), and sends it to the server device 200.

[0057] Such a security function selection device 100B may select security functions for one or more server devices 200. For example, there may be a security function selection device 100B for each zone, such as a trusted zone or a demilitarized zone, and security functions to be operated may be selected for each server device 200 in the zone. Assuming that server devices 200 in the same zone are attacked sequentially, the security function selection device 100B may select the same security functions for the server devices 200.

[0058] Only the security functions that are necessary and sufficient for the cyber-attack situation, selected by security function selection device 100B, are in operation on server device 200. This reduces the processing costs of security functions, making it possible to provide a secure network function infrastructure at low processing costs.

[0059] <Other Modifications> Although several embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. In the above-described embodiments, when an attack is detected (emergency), the security functions in the emergency security function 122 are activated. In an emergency, the security functions in the normal time security function 121 may also be activated. In this way, it becomes possible to detect attacks launched by attackers other than the attacker launching the attack detected by the security functions in the emergency security function 122.

[0060] In the above-described embodiment and modified examples, detection functions and countermeasure functions corresponding to attack methods that are expected to occur after a detected attack method are in operation. Alternatively, only the countermeasure function corresponding to the detected attack method and the detection function for the attack method that is expected to be executed subsequently may be in operation. In this case, only the detection function is in operation for the normal security function 121. This makes it possible to reduce the number of security functions in operation, and to implement security measures suitable for systems with stricter real-time requirements.

[0061] By selecting and operating security functions as described above, it is possible to implement security measures suitable for systems with strict resource limitations, such as IoT devices, where hardware resources are limited.

[0062] The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications are included in the scope and spirit of the invention described in this specification, etc., and are also included in the invention described in the claims and their equivalents.

[0063] <Hardware Configuration> The security function selection device 100, 100A according to the above-described embodiment is realized by a computer 900 having a configuration as shown in FIG. 8, for example. FIG. 8 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the security function selection device 100, 100A according to the present embodiment. The computer 900 includes a CPU 901, a ROM 902, a RAM 903, an SSD 904, an input / output interface 905 (referred to as an input / output I / F (Interface) in FIG. 8), a communication interface 906 (referred to as a communication I / F in FIG. 8), and a media interface 907 (referred to as a media I / F in FIG. 8). The computer 900 may include a hard disk drive (HDD) instead of the SSD 904, or may include an HDD in addition to the SSD 904.

[0064] The CPU 901 operates based on a program stored in the ROM 902 or the SSD 904, and performs control by the control unit 110 in Fig. 1. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started up, programs related to the hardware of the computer 900, and the like.

[0065] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output interface 905. The CPU 901 acquires data from the input device 910 via the input / output interface 905, and outputs generated data to the output device 911.

[0066] The SSD 904 stores programs executed by the CPU 901 and data used by the programs. The communication interface 906 receives data from other devices (not shown) (for example, terminals using a network function platform) via a communication network and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0067] The media interface 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads the program from the recording medium 912 onto the RAM 903 via the media interface 907 and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disk), a magneto-optical recording medium such as an MO (Magneto Optical Disk), a magnetic recording medium, a conductive memory tape medium, a semiconductor memory, or the like.

[0068] For example, when the computer 900 functions as the security function selecting device 100, 100A according to the above-described embodiment, the CPU 901 of the computer 900 executes the program 123 (see FIG. 1 ) loaded onto the RAM 903, thereby realizing the functions of the security function selecting device 100, 100A. The CPU 901 reads and executes the program from the recording medium 912. Alternatively, the CPU 901 may read the program from another device via a communications network, or may install and execute the program 123 from the recording medium 912 onto the SSD 904.

[0069] <Effects> The effects of the device will be described below.

[0070] The security function selection device 100, 100A according to the above-described embodiments includes a storage unit 120 that stores an attack tactic database 140, 140A that stores attack tactics to be executed in sequence in a cyber-attack against a network function infrastructure, and one or more attack techniques included in each of the attack tactics. The storage unit 120 stores a security function database 150 that stores detection functions that detect attacks using attack techniques and countermeasure functions that are countermeasures against attacks using attack techniques.

[0071] The security function selection device 100, 100A includes an information collection unit 112, 112B that collects attack information related to attacks detected by the detection functions. The security function selection device 100, 100A also includes a function selection unit 114, 114B that references an attack tactic database 140, 140A and selects detection functions and countermeasure functions corresponding to attack methods of attack tactics that will be executed after the attack tactics of the attack method corresponding to the detection function that detected the collected attack information.

[0072] With such security function selection devices 100 and 100A, it is possible to reduce the processing costs of security functions compared to the conventional method of operating one huge security function that responds to a wide variety of threats, and ultimately to provide a secure network function infrastructure with low processing costs.

[0073] The attack tactic database 140A according to the embodiment described above includes, for an attack technique included in an attack tactic, a next attack technique that is an attack technique included in the next attack tactic of the attack tactic that will be adopted after the attack technique. The function selection units 114 and 114B select detection functions and countermeasure functions corresponding to attack techniques that include the next attack technique for the attack technique corresponding to the detection function that detected the collected attack information.

[0074] With this security function selection device 100, 100A, the corresponding security functions are activated only for attack methods related to the detected attack (attack method), thereby providing a secure network function infrastructure with even lower processing costs.

[0075] 100, 100A, 100B Security function selection device 110 Control unit 111 Application function unit (server) 112, 112B Information collection unit 113 Countermeasure unit 114 Function selection unit 115 Function control unit 120 Storage unit 121 Peacetime security function 122 Emergency security function 123 Program 130 Application data 140, 140A Attack tactics database 150 Security function database 160 Detection information database

Claims

1. A security function selection device comprising: an attack tactics database that stores attack tactics that are executed in sequence in a cyber-attack against a network function infrastructure, and one or more attack methods included in each of the attack tactics; a storage unit that stores a security function database that stores detection functions that detect attacks using the attack methods and countermeasure functions that are countermeasures against attacks using the attack methods; an information collection unit that collects attack information related to attacks detected by the detection functions; and a function selection unit that refers to the attack tactics database and selects detection functions and countermeasure functions that correspond to attack methods of attack tactics that are executed after the attack tactics of the attack method that corresponds to the detection function that detected the collected attack information.

2. The security function selection device according to claim 1, wherein the attack tactic database includes, for an attack method included in the attack tactic, a next attack method which is an attack method included in the next attack tactic to be adopted after the attack method included in the attack tactic, and the function selection unit selects detection functions and countermeasure functions corresponding to attack methods including the next attack method for the attack method corresponding to the detection function that detected the collected attack information.

3. A program for causing a computer to function as the security function selection device of claim 1, the computer having a storage unit that stores an attack tactics database that stores attack tactics that are executed in sequence in a cyber-attack against a network function infrastructure and one or more attack methods included in each of the attack tactics, and a security function database that stores detection functions that detect attacks using the attack methods and countermeasure functions that are countermeasures against attacks using the attack methods.

4. A security function selection method in which a security function selection device has a memory unit that stores an attack tactic database that stores attack tactics that are executed in sequence in a cyber-attack against a network function infrastructure and one or more attack methods included in each of the attack tactics, and a security function database that stores detection functions that detect attacks using the attack methods and countermeasure functions that are countermeasures against attacks using the attack methods, the security function selection device performing the following steps: collecting attack information related to attacks detected by the detection functions; and referring to the attack tactic database to select detection functions and countermeasure functions that correspond to the attack methods of attack tactics that are executed after the attack tactics of the attack method that corresponds to the detection function that detected the collected attack information.

Images