Attack path display control device, attack path display control method, and recording medium in which attack path display control program is stored

Abstract

An attack path display control device 30 comprises: an extraction unit 31 for extracting, from information 300 representing a configuration of an information processing system, a plurality of attack paths 310 which lead from one attack target to other attack targets in a cyber-attack on the information processing system; an acquisition unit 32 for acquiring, for the attack targets in the attack paths 310, information representing attributes 320 related to the risk that the cyber-attack will succeed; a determination unit 33 for determining whether or not an aggregation condition 330 that represents that, among the plurality of attack paths 310 extracted by the extraction unit 31, the number of the attack targets and the attributes 320 in one attack path 310 and the number of the attack targets and the attributes 320 in another attack path 310 are equal to each other is satisfied; and a display control unit 34 for aggregating and displaying, on a display device 40, the plurality of attack paths 310 comprising combinations of the attack paths 310 satisfying the aggregation condition 330. Accordingly, the attack path display control device presents a complicated analysis result regarding the attack paths 310 of a cyber-attack in a manner that is easy to understand.

Description

Attack path display control device, attack path display control method, and recording medium storing attack path display control program

[0001] The present invention relates to an attack path display control device, an attack path display control method, and a recording medium storing an attack path display control program.

[0002] In recent years, cyberattacks, including unauthorized access or malware infection, have been rampant against computer systems, including those in factories and medical facilities, causing great damage to our highly information-oriented society. Therefore, there is a need for technology that can help system administrators to efficiently conduct risk assessments of their systems in preparation for such cyberattacks.

[0003] In relation to the above-mentioned technology, Patent Literature 1 discloses an analysis system that can display attack paths so that a security administrator can easily determine which attack paths require priority countermeasures. This system identifies the network topology of devices included in a system to be diagnosed. This system detects attack paths that indicate the flow of feasible attacks in the system to be diagnosed based on security information related to the devices. This system then superimposes the attack paths on the network topology and displays the attack paths on a display device. In this case, this system displays the attack paths on the display device in a manner that corresponds to the impact on the system to be diagnosed.

[0004] International Publication No. 2020 / 195228

[0005] In recent years, the number of attack vectors for cyberattacks against large-scale computer systems has become enormous, making it necessary to appropriately and efficiently assess the risk of such systems. It is important to clearly present security issues related to attack vectors in a computer system to users (administrators) of the computer system, taking into account factors such as the likelihood of a cyberattack being received and the likelihood of the cyberattack being successful. However, as described above, the number of attack vectors in a large-scale computer system is enormous, and presenting the complex attack vectors extracted by analyzing the computer system to users as is can be problematic, making it difficult for users to grasp the issues. In other words, the challenge is to clearly present the complex analysis results related to cyberattack vectors. The technology disclosed in Patent Document 1 cannot be said to be sufficient to solve this problem.

[0006] The main purpose of the present invention is to present the results of complex analysis of cyber-attack routes in an easy-to-understand manner.

[0007] An attack path display control device according to one embodiment of the present invention comprises an extraction means for extracting, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system; an acquisition means for acquiring information representing attributes of the attack targets in the attack paths that are related to the risk of the cyber attack being successful; a determination means for determining whether or not each of the multiple attack paths extracted by the extraction means satisfies an aggregation condition that represents that the number of attack targets and the attributes of one attack path are equal to the number of attack targets and the attributes of other attack paths; and a display control means for aggregating and displaying on a display device multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition.

[0008] In another aspect of achieving the above-mentioned object, an attack path display control method according to one embodiment of the present invention uses an information processing device to extract, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system, obtain information representing attributes of the attack targets in the attack paths that are related to the risk of the cyber attack being successful, determine whether or not each of the extracted attack paths satisfies an aggregation condition that represents that the number of attack targets and the attributes in one attack path are equal to the number of attack targets and the attributes in other attack paths, and aggregate and display on a display device multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition.

[0009] In addition, in a further aspect of achieving the above-mentioned object, an attack path display control program according to one embodiment of the present invention causes a computer to execute the following steps: an extraction process that extracts, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system; an acquisition process that acquires information representing attributes related to the risk of the cyber attack being successful for the attack targets included in the attack paths; a determination process that determines whether or not each of the multiple attack paths extracted by the extraction process satisfies an aggregation condition that represents that the number of attack targets and the attributes of one attack path are equal to the number of attack targets and the attributes of other attack paths; and a display control process that aggregates and displays on a display device multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition.

[0010] Furthermore, the present invention can also be realized by a computer-readable, non-volatile recording medium on which such an attack path display control program (computer program) is stored.

[0011] The present invention can present the results of complex analysis of cyber-attack routes in an easy-to-understand manner.

[0012] FIG. 1 is a block diagram showing the configuration of an attack path display control device 10 according to the present disclosure. FIG. 2 is a diagram showing a schematic example of the attack path display control device 10 according to the present disclosure aggregating attack paths 152 and displaying them on a display screen 21. FIG. 3 is a diagram showing an example of the contents of the aggregation conditions 156 in the attack path display control device 10 according to the present disclosure. FIG. 4 is a flowchart showing the operation of the attack path display control device 10 according to the present disclosure. FIG. 5 is a block diagram showing the configuration of an attack path display control device 30 according to the present disclosure. FIG. 6 is a flowchart showing the operation of the attack path display control device 30 according to the present disclosure. FIG. 7 is a block diagram showing the configuration of an information processing device 900 that can realize the attack path display control device according to the present disclosure.

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0014] 1 is a block diagram showing the configuration of an attack path display control device 10 according to the present disclosure. The attack path display control device 10 is a device that presents complicated attack paths to a user in an easy-to-understand manner by aggregating (bundling) multiple attack paths that satisfy predetermined conditions regarding attack paths from an entry point of a cyber attack to an attack target against an information processing system (not shown) that is the target of security diagnosis.

[0015] The attack path display control device 10 is communicably connected to a terminal device 20. The terminal device 20 is an information processing device such as a personal computer, smartphone, tablet terminal, etc., and is an example of a display device. The terminal device 20 inputs information entered by a user through input operations to the attack path display control device 10, and displays the information output from the attack path display control device 10 on a display screen 21 provided therewith.

[0016] The attack path display control device 10 is an information processing device such as a server, and includes an extraction unit 11, an acquisition unit 12, a determination unit 13, a display control unit 14, and a memory unit 15. The extraction unit 11, the acquisition unit 12, the determination unit 13, and the display control unit 14 are examples of extraction means, acquisition means, determination means, and display control means, respectively.

[0017] The storage unit 15 is, for example, a storage device such as a RAM (Random Access Memory) 903 or a hard disk 904, which will be described later with reference to Fig. 7. The storage unit 15 stores information processing system configuration information 151, attack paths 152, risk information 153, attribute information 154, countermeasure implementation status information 155, and aggregation conditions 156. Details of the above-mentioned information stored in the storage unit 15 will be described later.

[0018] The extraction unit 11 extracts a plurality of attack paths 152 from an entry point to an attack target in a cyber attack against an information processing system from information processing system configuration information 151 that represents the configuration of the information processing system to be diagnosed in terms of security. The information processing system configuration information 151 may be provided by, for example, a user of the attack path display control device 10, or may be obtained by the attack path display control device 10 from an external device.

[0019] The information processing system configuration information 151 includes the topology of a communication network that communicatively connects devices included in the information processing system to be diagnosed, and information regarding the security specifications of the devices. The extraction unit 11 can extract multiple attack paths 152 from an entry point to an attack target in a cyber attack against the information processing system from the topology of the communication network, etc., using existing technology. The extraction unit 11 stores the extracted attack paths 152 in the storage unit 15.

[0020] Fig. 2 is a diagram illustrating a schematic example of a cyber-attack attack path 152 extracted by the extraction unit 11 in the attack path display control device 10 according to the present disclosure. While recent large-scale information processing systems include many cyber-attack attack paths such as those illustrated in Fig. 2, a simplified example will be used for explanation here. In Fig. 2, the entry points, attack targets, and attack targets are devices (equipment) such as servers, terminals, and switches included in the information processing system to be diagnosed, or firewalls running as applications in the devices.

[0021] In the example shown in Figure 2, as shown in the left diagram, the extraction unit 11 extracts an attack path 152 from entry point X to attack target Y via attack target A, attack target B, and attack target D, and an attack path 152 from entry point X to attack target Y via attack target A, attack target C, and attack target D.

[0022] The acquisition unit 12 shown in FIG. 1 acquires risk information 153, attribute information 154, and countermeasure implementation status information 155, for example, from an external device. For example, if the information processing system configuration information 151 includes the risk information 153, attribute information 154, and countermeasure implementation status information 155, the acquisition unit 12 may acquire (extract) this information from the information processing system configuration information 151. For example, the acquisition unit 12 may acquire the risk information 153 from information regarding the security specifications of each attack target represented by the information processing system configuration information 151. For example, the acquisition unit 12 may acquire this information provided by a user of the attack path display control device 10, etc. The acquisition unit 12 stores the acquired risk information 153, attribute information 154, and countermeasure implementation status information 155 in the storage unit 15.

[0023] The risk information 153 is information that indicates the risk of a successful cyberattack on each attack target (including the attack target) included in the attack path 152. The risk of a successful cyberattack on an attack target can be determined, for example, by two indicators: the threat level and the vulnerability level. The threat level is an indicator of the likelihood of a cyberattack occurring, and depends on the location of the attack target, the type of OS (Operating System) and software used, the communication function, the functions provided, etc. The vulnerability level is an indicator of the likelihood that the attack method will be successful in the event of a cyberattack, and depends on the status of security measures such as antivirus software.

[0024] The attribute information 154 is information that indicates attributes related to the risk indicated by the risk information 153 for each attack target (including the attack target) included in the attack path 152. The attributes indicated by the attribute information 154 indicate the type of attack target (asset type), for example, a device (equipment) such as a server, terminal, or switch, or a firewall running as an application on a device.

[0025] The countermeasure implementation status information 155 represents the implementation status of security countermeasures that meet predetermined criteria for each attack target (including the attack target) included in the attack path 152. The predetermined criteria, for example, represent that the security countermeasure has a clear effect of reducing the risk of a successful cyber attack. Examples of security countermeasures represented by the countermeasure implementation status information 155 include antivirus software, intrusion prevention systems (IPS), virtual patches, application whitelists, minimum privilege assignment, patch application, etc. Note that application whitelists are a mechanism for preventing the execution of malicious software by restricting the execution of only applications registered on the whitelist (i.e., applications whose safety has been confirmed) to execution.

[0026] The determination unit 13 determines whether the aggregation condition 156, which indicates that the number of attack targets and the attributes indicated by the attribute information 154 in the multiple attack paths 152 extracted by the extraction unit 11 are equal to each other, is satisfied. The aggregation condition 156 is a condition used by the determination unit 13 when determining whether to aggregate (bundle) multiple attack paths 152 into one and present it to the user. Generally, attack paths with the same number of attack targets and attributes are considered to have equivalent security characteristics. The aggregation condition 156 is based on the idea that multiple attack paths with equivalent security characteristics can be aggregated and presented without presenting all of them, allowing the user to understand security issues. The aggregation condition 156 may be provided by the user, for example, or may be acquired by the attack path display control device 10 from an external device.

[0027] Here, the significance of the attack path display control device 10 using the attribute information 154 will be explained. For example, if all of the targets along the attack path (entry point → attack target → attack objective) are servers, it is sufficient for the user to recognize that there is a path from the entry point to the attack target in two steps, using some kind of device as a springboard. On the other hand, if the target of attack includes a firewall, the impact of a successful cyber attack is greater than that of a single device, such as a server, and therefore the user needs to understand the placement status of the firewall in the system. The attack path display control device 10 presents the attack path 152 to the user in an easy-to-understand manner based on the attribute information 154, taking into account such policies.

[0028] 3 is a diagram illustrating the content of the aggregation condition 156 in the attack path display control device 10 according to the present disclosure. The aggregation condition 156 indicates that, for multiple attack paths 152 between certain attack targets, if the number of attack targets included is equal, those attack paths 152 are candidates for aggregation.

[0029] In the example shown in Figure 3, the aggregation conditions 156 represent three methods (policies) for aggregating two attack paths 152: aggregation method 1-1, aggregation method 1-2, and aggregation method 2. Compared to aggregation methods 1-1 and 1-2, aggregation method 2 has stricter conditions for aggregation (i.e., it places more importance on the amount of information provided than on readability). Furthermore, as will be described later, aggregation methods 1-1 and 1-2 differ only in the way security measures are displayed in case 3, with aggregation method 1-1 placing more importance on the amount of information provided than aggregation method 1-2.

[0030] The aggregation conditions 156 may include only one of the three aggregation methods illustrated in Fig. 3, or may include all three aggregation methods illustrated in Fig. 3, and the determination unit 13 may select one of the aggregation methods according to information input by a user to the attack path display control device 10. Note that the aggregation conditions 156 illustrated in Fig. 3 are just an example, and the aggregation conditions 156 may include content different from that illustrated in Fig. 3.

[0031] 3 is divided into six cases, and indicates whether or not to aggregate attack targets included in the attack paths 152 for each aggregation method. For cases 3 to 6, the aggregation conditions 156 also indicate how to display security countermeasures (hereinafter sometimes abbreviated as "countermeasures") related to the aggregated attack paths 152.

[0032] 3 shows a case where the two attack paths 152 to be aggregated have the same attributes as the attack targets indicated by the attribute information 154, and no security measures that meet the predetermined criteria have been implemented. The aggregation condition 156 indicates that the attack paths 152 are aggregated in all three aggregation methods in Case 1.

[0033] 3 illustrates a case where the two attack paths 152 to be aggregated have different attributes of the attack targets indicated by the attribute information 154, and security measures that meet the predetermined criteria have not yet been implemented. The aggregation condition 156 indicates that the attack paths 152 should not be aggregated in any of the three aggregation methods in case 2.

[0034] 3 illustrates a case where, for two attack paths 152 for which aggregation is to be determined, the attributes of the included attack targets indicated by the attribute information 154 are the same, and security measures that meet the predetermined criteria are implemented only for the attack path with a lower total value (risk) obtained by adding up the risk values ​​indicated by the danger information 153 for the included attack targets. In case 3, the aggregation conditions 156 indicate that in aggregation method 1-1, the attack paths 152 are aggregated and security measures are displayed; in aggregation method 1-2, the attack paths 152 are aggregated and security measures are not displayed; and in aggregation method 2, the attack paths 152 are not aggregated (security measures are displayed as they are).

[0035] 3 shows a case where, for two attack paths 152 for which aggregation is to be determined, the attributes of the included attack targets indicated by the attribute information 154 are the same, and security measures that meet the predetermined criteria are implemented only for the attack path with the higher total value (risk) obtained by adding up the risk values ​​indicated by the danger information 153 for the included attack targets. In case 4, the aggregation condition 156 indicates that the attack paths 152 are aggregated and security measures are displayed in aggregation methods 1-1 and 1-2, but that the attack paths 152 are not aggregated in aggregation method 2 (the security measures are displayed as they are).

[0036] 3 shows a case where two attack paths 152, which are the targets of aggregation, have the same attributes of the attack targets indicated by the attribute information 154, the same risks, and the same security measures that meet predetermined criteria are implemented. In case 5, the aggregation condition 156 indicates that the attack paths 152 are aggregated and the security measures are aggregated and displayed in any of the three aggregation methods.

[0037] 3 illustrates a case in which two attack paths 152, the targets of which are to be aggregated, have the same attributes as the attack targets indicated by the attribute information 154, the same risks, and different security measures that meet predetermined criteria have been implemented. In case 6, the aggregation conditions 156 indicate that the attack paths 152 are aggregated and both security measures are displayed in aggregation methods 1-1 and 1-2, but that the attack paths 152 are not aggregated in aggregation method 2 (the security measures are displayed as they are).

[0038] The aggregation condition 156 illustrated in FIG. 3 can be organized as follows, for example.

[0039] (1) Multiple attack paths 152 are aggregated if the number and attributes of the included attack targets are equal.

[0040] (2) In relation to (1), as shown for each aggregation method in cases 3 to 6, a determination is made as to whether or not to aggregate multiple attack paths 152 depending on the risk and the implementation status of security measures.

[0041] (3) In relation to (2), as shown in the aggregation methods 1-1 and 1-2 in cases 3 to 6, for multiple attack paths 152, the total values ​​(risks) representing the danger of the included attack targets are aggregated regardless of whether they are equal, and the type of security measure is displayed according to the total value (risk).

[0042] (4) In relation to (3), as shown for aggregation method 1-2 in cases 3 to 5, the type of security measures implemented against the target of attack included in the attack path 152 with the highest total value (risk) among multiple attack paths 152 is displayed.

[0043] (5) In relation to (4), as shown for aggregation method 1-2 in Case 6, if there are multiple attack paths 152 with the highest total value (risk) among multiple attack paths 152, the types of one or more security measures implemented against the attack targets included in the attack path 152 with the highest total value are displayed.

[0044] (6) In relation to (3), as shown for aggregation method 1-1 in cases 3 to 6, displays the types of one or more security measures implemented against attack targets included in at least one of the multiple attack paths 152.

[0045] (7) In relation to (2), as shown in the aggregation method 2 in cases 3, 4, and 6, if the total value (risk) of the values ​​representing the danger of the included attack targets differs for multiple attack paths 152, they are excluded from the aggregation targets.

[0046] (8) In relation to (2), as shown in the aggregation method 2 in cases 3, 4, and 6, if the types of security measures implemented against the included attack targets are different for multiple attack paths 152, they are excluded from the aggregation targets.

[0047] The display control unit 14 aggregates multiple attack paths 152 that satisfy the aggregation condition 156 described above and displays them on the display screen 21 of the terminal device 20. For example, the display control unit 14 aggregates two attack paths 152 from attack target A (one attack target) to attack target D (another attack target) illustrated on the left side of Fig. 2 as illustrated on the right side of Fig. 2 and displays them on the display screen 21.

[0048] The display control unit 14 may display, on the display screen 21, information indicating attack targets included in the multiple attack paths 152 aggregated and displayed on the display screen 21. The display control unit 14, for example, displays, on the display screen 21, information that identifies attack targets included in the multiple attack paths 152 aggregated and displayed on the display screen 21 and / or the number of attack targets included in the multiple attack paths 152. More specifically, as illustrated on the right side of FIG. 2 , the display control unit 14 may display information indicating that the attack targets are attack targets B and C, or information indicating that two attack targets are included (the number of attack targets is two), on icons representing attack targets B and C aggregated and displayed. The display control unit 14 may also display information that identifies the attack targets aggregated and displayed according to a predetermined priority. For example, the display control unit 14 may display the identifiable information for attack targets that are more dangerous than those indicated by the danger information 153 (e.g., in order, starting with the attack target with the highest priority).

[0049] The display control unit 14 may also display attack targets included in multiple attack paths 152 that are aggregated and displayed on the display screen 21 in a display format that is different from attack targets included in attack paths 152 that are not aggregated and displayed on the display screen 21. In this case, the display format may represent, for example, the shape, color, or background of an icon representing the attack targets included in the attack paths 152. For example, the display control unit 14 may display multiple attack targets that are aggregated and displayed using an icon that represents an image in which multiple icons are superimposed.

[0050] 2 , measure A, measure B, measure C, measure D, and measure Y respectively represent the types of security measures implemented for attack target A, attack target B, attack target C, attack target D, and attack target Y. Similarly, measure XA, measure AB, measure AC, measure BD, measure CD, and measure DY respectively represent the types of security measures implemented for the communication networks that communicably connect between entry point X and attack target A, between attack target A and attack target B, between attack target A and attack target C, between attack target B and attack target D, between attack target C and attack target D, and between attack target D and attack target Y.

[0051] For example, the display control unit 14 displays on the display screen 21 the types of security measures that are indicated to be displayed by the aggregation conditions 156 illustrated in Figure 3 above, for the attack path 152 that is being aggregated and displayed.

[0052] Furthermore, the display control unit 14 may, for example, display security measures such as a firewall, which are of high security importance, on the display screen 21 with priority.

[0053] In the example shown in FIG. 2 , there are two attack paths 152 from attack target A to attack target D, which are the targets of aggregation, and each of the attack paths 152 has one attack target (attack target B or attack target C) along its path. However, the attack paths 152 to be aggregated may be more complex. For example, there may be three or more attack paths 152 from attack target A to attack target D, and each of the attack paths 152 may have two or more attack targets along its path. In this case, the attack path display control device 10 may aggregate and display multiple attack paths 152 in the same manner as the above-described processing. Furthermore, for example, if there are three or more attack paths 152 from attack target A to attack target D, which are the targets of aggregation, the attack path display control device 10 may aggregate and display only some of the attack paths 152 that satisfy the aggregation condition 156 among the three or more attack paths 152, and may display the attack paths 152 that do not satisfy the aggregation condition 156 without aggregating them.

[0054] Next, the operation (processing) of the attack path display control device 10 according to the present disclosure will be described in detail with reference to the flowchart of FIG.

[0055] The extraction unit 11 extracts attack paths 152 in cyber attacks from the information processing system configuration information 151 (step S101). The acquisition unit 12 acquires risk information 153, attribute information 154, and countermeasure implementation status information 155 related to the attack targets in the attack paths 152 extracted from the information processing system configuration information 151 (step S102). The determination unit 13 compares the risk information 153, attribute information 154, and countermeasure implementation status information 155 with the aggregation conditions 156 (step S102).

[0056] If the risk information 153, attribute information 154, and countermeasure implementation status information 155 satisfy the conditions for aggregating and displaying the attack paths 152 represented by the aggregation conditions 156 (Yes in step S104), the display control unit 14 aggregates the attack paths 152 and displays them on the display screen 21, and displays the security measures on the display screen 21 as indicated by the aggregation conditions 156 (step S105), and the overall processing is then terminated.

[0057] If the risk information 153, attribute information 154, and countermeasure implementation status information 155 do not satisfy the conditions for aggregating and displaying the multiple attack paths 152 represented by the aggregation conditions 156 (No in step S104), the display control unit 14 displays the multiple attack paths 152 as is on the display screen 21 without aggregating them (step S106), and the overall processing ends.

[0058] The attack path display control device 10 according to the present disclosure can present complex analysis results regarding the attack paths of cyber attacks in an easy-to-understand manner. This is because, when aggregating conditions 156 are satisfied, which indicate that the number and attributes of multiple attack paths 152 from one attack target to another attack target in a cyber attack against an information processing system are equal, the attack path display control device 10 aggregates and displays those attack paths 152 on the display screen 21.

[0059] The effects achieved by the attack path display control device 10 according to the present disclosure will be described in detail below.

[0060] In recent years, the number of attack vectors for cyberattacks against large-scale computer systems has become enormous, making it necessary to conduct appropriate and efficient risk assessments of such systems. It is also important to clearly present security issues related to attack vectors in computer systems to users (administrators) of the computer systems, taking into account factors such as the likelihood of a cyberattack being received and the likelihood of a cyberattack being successful. However, as mentioned above, the number of attack vectors in large-scale computer systems is enormous, and presenting the complex attack vectors extracted by analyzing the computer system to users as is can be problematic, making it difficult for users to grasp the issues. In other words, the challenge is to clearly present the complex analysis results of cyberattack vectors.

[0061] To address this issue, the attack path display control device 10 according to the present disclosure extracts, from information processing system configuration information 151, multiple attack paths 152 leading from one attack target to other attack targets in a cyberattack against the information processing system. The attack path display control device 10 acquires attribute information 154 representing attributes related to the risk of a cyberattack succeeding for the attack targets in the attack paths 152. The attack path display control device 10 determines whether each of the multiple attack paths 152 extracted by the extraction unit 11 satisfies an aggregation condition 156 representing that the number of attack targets and the attributes of one attack path 152 are equal to the number of attack targets and the attributes of the other attack paths 152. The attack path display control device 10 then aggregates the multiple attack paths 152, each consisting of a combination of attack paths 152 that satisfy the aggregation condition 156, and displays the aggregated attack paths 152 on the display screen 21 of the terminal device 20. In other words, the attack path display control device 10 reduces the complexity of the analysis results of attack paths by aggregating multiple attack paths that exist between certain attack targets when the attack paths are deemed to have equivalent security characteristics, and can therefore present the analysis results (extraction results of attack paths) automatically and in an easy-to-understand manner rather than manually.

[0062] Furthermore, the attack path display control device 10 according to the present disclosure displays information representing the attack targets in the aggregated and displayed multiple attack paths 152 (for example, information that can identify the attack targets, or the number of attack targets in the multiple attack paths 152) on the display screen 21. This allows the attack path display control device 10 to appropriately present information about the attack paths 152 even when multiple attack paths 152 are aggregated.

[0063] Furthermore, the attack path display control device 10 according to the present disclosure displays on the display screen 21 attack targets in the aggregated and displayed multiple attack paths 152 in a display format (for example, any of the shape, color, and background of the icon representing the attack target) that differs from the attack targets in the non-aggregated displayed attack paths 152. This allows the attack path display control device 10 to more reliably allow the user to recognize that multiple attack paths 152 are being aggregated and displayed.

[0064] Furthermore, the attack path display control device 10 according to the present disclosure acquires risk information 153 indicating the risk of an attack target along an attack path 152 and countermeasure implementation status information 155 indicating the implementation status of security measures that meet predetermined criteria, and determines whether the risk information 153 and the countermeasure implementation status information 155 satisfy aggregation conditions 156 according to the risk and the implementation status. The attack path display control device 10 then aggregates multiple attack paths 152 based on the aggregation conditions 156, for example, as described above with reference to FIG. 3, and controls the display of security measures along the attack paths 152. This allows the attack path display control device 10 to present complex analysis results related to cyber-attacks in an easy-to-understand and appropriate manner.

[0065] 5 is a block diagram showing the configuration of an attack path display control device 30 according to the present disclosure. The attack path display control device 30 includes an extraction unit 31, an acquisition unit 32, a determination unit 33, and a display control unit 34. The extraction unit 31, the acquisition unit 32, the determination unit 33, and the display control unit 34 are examples of extraction means, acquisition means, determination means, and display control means, respectively.

[0066] The extraction unit 31 extracts, from information 300 representing the configuration of an information processing system, multiple attack paths 310 leading from one attack target to another attack target in a cyber attack against the information processing system. The information 300 representing the configuration of the information processing system is, for example, information similar to the information processing system configuration information 151 related to the attack path display control device 10. The attack paths 310 are, for example, information similar to the attack path 152 related to the attack path display control device 10. The extraction unit 31 operates in the same manner as the extraction unit 11 related to the attack path display control device 10, for example.

[0067] The acquisition unit 32 acquires information representing attributes 320 related to the risk of a cyber attack succeeding for the target of attack on the attack path 310. The information representing the attributes 320 is, for example, information similar to the attribute information 154 related to the attack path display control device 10. The acquisition unit 32 operates in the same manner as the acquisition unit 12 related to the attack path display control device 10, for example.

[0068] The determination unit 33 determines whether or not an aggregation condition 330 is satisfied, which indicates that the number of attack targets and attributes 320 in one attack path 310 are equal to the number of attack targets and attributes 320 in another attack path 310 among the multiple attack paths 310 extracted by the extraction unit 31. The aggregation condition 330 is, for example, information similar to the aggregation condition 156 in the attack path display control device 10. The determination unit 33 operates in the same manner as the determination unit 13 in the attack path display control device 10, for example.

[0069] The display control unit 34 aggregates multiple attack paths 310 consisting of combinations of attack paths 310 that satisfy the aggregation conditions 330 and displays them on the display device 40. The display device 40 is, for example, a device similar to the terminal device 20 related to the attack path display control device 10. The display control unit 34 operates, for example, in the same manner as the display control unit 14 related to the attack path display control device 10.

[0070] Next, the operation (processing) of the attack path display control device 30 according to the present disclosure will be described in detail with reference to the flowchart of FIG. 6 .

[0071] The extraction unit 31 extracts multiple attack paths 310 from one target of attack to another target of attack in a cyber attack against the information processing system from information 300 representing the configuration of the information processing system (step S201). The acquisition unit 32 acquires information representing attributes 320 related to the risk of a cyber attack succeeding for the target of attack on the attack path 310 (step S202).

[0072] The determination unit 33 determines whether or not each of the attack paths 310 extracted by the extraction unit 31 satisfies an aggregation condition 330, which indicates that the number of attack targets and the attributes 320 of one attack path 310 are equal to the number of attack targets and the attributes 320 of the other attack paths 310 (step S203). The display control unit 34 aggregates the attack paths 310, each consisting of a combination of attack paths 310 that satisfy the aggregation condition 330, and displays them on the display device 40 (step S204), and the entire processing ends.

[0073] The attack path display control device 30 according to the present disclosure can present complex analysis results regarding attack paths of cyber attacks in an easy-to-understand manner. This is because, when a consolidation condition 330 is satisfied, which indicates that the number and attributes of multiple attack paths 310 from one attack target to other attack targets in a cyber attack against an information processing system, the attack path display control device 30 consolidates those attack paths 310 and displays them on the display device 40.

[0074] <Hardware Configuration Example> In each of the above-described embodiments, each unit in the attack path display control device shown in Figures 1 and 5 can be realized by dedicated HW (Hardware) (electronic circuitry). Furthermore, in Figures 1 and 5, at least the following components can be considered as functional (processing) units (software modules) of a software program that includes instructions executed by a processor: Extraction units 11 and 31, Acquisition units 12 and 32, Determination units 13 and 33, Display control units 14 and 34, and Storage control function in the storage unit 15.

[0075] However, the division of the various components shown in these drawings is for the sake of convenience of explanation, and various configurations may be assumed for implementation. An example of the hardware environment in this case will be described with reference to FIG.

[0076] 7 is a diagram illustrating an example of the configuration of an information processing device 900 (computer) capable of realizing the attack path display control device according to the present disclosure. That is, FIG. 7 shows the configuration of a computer (information processing device) capable of realizing the attack path display control device shown in FIGS. 1 and 5, and represents a hardware environment capable of realizing each function in the above-described embodiment. However, each unit in the above-described attack path display control device may be distributed among multiple information processing devices 900, or at least some of the functions may be provided in a server or the like that constitutes a cloud computing environment.

[0077] The information processing device 900 shown in Fig. 7 includes the following components: a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM (Random Access Memory) 903, a hard disk (storage device) 904, a communication interface 905, a bus 906 (communication line), a reader / writer 908 capable of reading and writing data stored in a recording medium 907 such as a CD-ROM (Compact Disc Read Only Memory), and an input / output interface 909 such as a monitor, speaker, keyboard, etc.

[0078] That is, the information processing device 900 having the above-described components is a general computer in which these components are connected via a bus 906. The information processing device 900 may have multiple CPUs 901, or may have a CPU 901 configured with multiple cores. The information processing device 900 may also not have some of the above-described components.

[0079] The present invention, explained using the above-mentioned embodiment as an example, supplies a computer program capable of realizing the following functions to the information processing device 900 shown in FIG. 7. The functions are the functions described above in the block diagrams (FIGS. 1 and 5) or flowcharts (FIGS. 4 and 6) referred to in the description of the embodiment. The present invention is then achieved by reading the computer program into the CPU 901 of the hardware, interpreting it, and executing it. The computer program supplied to the device may be stored in a readable / writable volatile memory (RAM 903) or a non-volatile storage device such as a ROM 902 or a hard disk 904.

[0080] In the above case, the method of supplying the computer program to the hardware can be a currently common procedure, such as installing the program in the device via a recording medium 907 such as a CD-ROM, or downloading the program from an external source via a communication line such as the Internet. In such a case, the present invention can be considered to be constituted by the code constituting the computer program or the recording medium 907 on which the code is stored.

[0081] The present invention has been described above using the above-described embodiments as exemplary examples. However, the present invention is not limited to the above-described embodiments. In other words, the present invention can be applied in various aspects that can be understood by a person skilled in the art within the scope of the present invention.

[0082] Note that part or all of the above-described embodiments can also be described as follows: However, the present invention, which has been exemplarily described using the above-described embodiments, is not limited to the following.

[0083] (Supplementary Note 1) An attack path display control device comprising: an extraction means for extracting, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system; an acquisition means for acquiring information representing attributes related to the risk of the cyber attack succeeding for the attack targets in the attack paths; a determination means for determining whether or not each of the multiple attack paths extracted by the extraction means satisfies an aggregation condition representing that the number of attack targets and the attributes of one attack path are equal to the number of attack targets and the attributes of other attack paths; and a display control means for aggregating multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition and displaying them on a display device.

[0084] (Supplementary Note 2) The attack path display control device according to Supplementary Note 1, wherein the display control means displays, on the display device, information representing attack targets in the plurality of attack paths that are aggregated and displayed on the display device.

[0085] (Supplementary Note 3) The attack path display control device described in Supplementary Note 2, wherein the display control means displays on the display device either information that can identify attack targets in the multiple attack paths that are aggregated and displayed on the display device, or the number of attack targets in the multiple attack paths.

[0086] (Supplementary Note 4) The attack path display control device described in Supplementary Note 2, wherein the display control means displays the attack targets in the multiple attack paths that are aggregated and displayed on the display device in a display format that is different from the attack targets in the attack paths that are not aggregated and displayed on the display device.

[0087] (Supplementary Note 5) The attack path display control device according to Supplementary Note 4, wherein the display mode represents any one of a shape, a color, and a background of an icon representing an attack target in the attack path.

[0088] (Supplementary Note 6) An attack path display control device described in any one of Supplementary Notes 1 to 5, wherein the acquisition means acquires information representing the risk and information representing the implementation status of security measures that meet predetermined standards regarding an attack target on the attack path, and the determination means determines whether the information representing the risk and the information representing the implementation status meet the aggregation conditions according to the risk and the implementation status.

[0089] (Supplementary Note 7) The attack path display control device described in Supplementary Note 6, wherein the aggregation condition indicates that the attack paths are aggregated and displayed on the display device regardless of whether the total values ​​of the values ​​representing the risk of the included attack targets are equal to each other, and indicates a method of displaying the type of security measure according to the total value.

[0090] (Supplementary Note 8) The attack path display control device according to Supplementary Note 7, wherein the display control means displays, on the display device, the type of security measures implemented against the attack target included in the attack path with the highest total value among the plurality of attack paths.

[0091] (Supplementary Note 9) The attack path display control device according to Supplementary Note 8, wherein, when there are multiple attack paths with the highest total value among the multiple attack paths, the display control means displays on the display device one or more types of security measures implemented against the attack target included in the attack path with the highest total value.

[0092] (Supplementary Note 10) The attack path display control device according to Supplementary Note 7, wherein the display control means displays, on the display device, the types of one or more security measures implemented against an attack target in at least any of the plurality of attack paths.

[0093] (Supplementary Note 11) The attack path display control device according to Supplementary Note 6, wherein the aggregation condition indicates that if the total values ​​representing the risk of the attack target in the multiple attack paths are different, the attack targets are aggregated and excluded from the targets to be displayed on the display device.

[0094] (Supplementary Note 12) The attack path display control device according to Supplementary Note 6, wherein the aggregation condition indicates that if the types of the security measures implemented against the attack targets in the plurality of attack paths are different, the security measures are aggregated and excluded from the targets to be displayed on the display device.

[0095] (Supplementary Note 13) An attack path display control method, using an information processing device, extracting, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system; obtaining information representing attributes related to the risk of the cyber attack being successful for the attack targets in the attack paths; determining whether or not each of the extracted attack paths satisfies an aggregation condition representing that the number of attack targets and the attributes in one attack path are equal to the number of attack targets and the attributes in other attack paths; and aggregating and displaying on a display device multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition.

[0096] (Supplementary Note 14) The attack path display control method according to Supplementary Note 13, further comprising: displaying, on the display device, information representing attack targets in the plurality of attack paths that are aggregated and displayed on the display device.

[0097] (Supplementary Note 15) The attack path display control method according to Supplementary Note 14, wherein either information capable of identifying attack targets in the plurality of attack paths that is aggregated and displayed on the display device, or the number of attack targets in the plurality of attack paths is displayed on the display device.

[0098] (Supplementary Note 16) An attack path display control method according to Supplementary Note 14, wherein the attack targets in the multiple attack paths that are aggregated and displayed on the display device are displayed on the display device in a different display format from the attack targets in the attack paths that are not aggregated and displayed on the display device.

[0099] (Supplementary Note 17) The attack path display control method according to Supplementary Note 16, wherein the display mode represents any one of the shape, color, and background of an icon representing an attack target in the attack path.

[0100] (Supplementary Note 18) An attack path display control method described in any one of Supplementary Notes 13 to 17, which acquires information representing the risk and information representing the implementation status of security measures that meet predetermined criteria for an attack target on the attack path, and determines whether the information representing the risk and the information representing the implementation status meet the aggregation conditions according to the risk and the implementation status.

[0101] (Supplementary Note 19) The attack path display control method described in Supplementary Note 18, wherein the aggregation condition indicates that the attack paths are aggregated and displayed on the display device regardless of whether the total values ​​of the values ​​representing the risk of the included attack targets are equal to each other, and indicates a display method for the type of security measure according to the total value.

[0102] (Supplementary Note 20) The attack path display control method according to Supplementary Note 19, further comprising displaying on the display device a type of the security measure implemented against an attack target included in the attack path with the highest total value among the plurality of attack paths.

[0103] (Supplementary Note 21) The attack path display control method described in Supplementary Note 20, wherein, if there are multiple attack paths with the highest total value among the multiple attack paths, the display device displays the types of one or more security measures implemented against the attack target included in the attack path with the highest total value.

[0104] (Supplementary Note 22) The attack path display control method according to Supplementary Note 19, further comprising displaying, on the display device, the types of one or more security measures implemented against an attack target in at least one of the plurality of attack paths.

[0105] (Supplementary Note 23) The attack path display control method described in Supplementary Note 18, wherein the aggregation condition indicates that if the total values ​​representing the risk of the attack target in the multiple attack paths are different, the attack targets are aggregated and excluded from the targets to be displayed on the display device.

[0106] (Supplementary Note 24) The attack path display control method according to Supplementary Note 18, wherein the aggregation condition indicates that if the types of security measures implemented against attack targets in the multiple attack paths are different, the security measures are aggregated and excluded from targets to be displayed on the display device.

[0107] (Supplementary Note 25) A recording medium storing an attack path display control program for causing a computer to execute the following steps: an extraction process for extracting, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system; an acquisition process for acquiring information representing attributes related to the risk of the cyber attack succeeding for the attack targets included in the attack paths; a determination process for determining whether or not each of the multiple attack paths extracted by the extraction process satisfies an aggregation condition representing that the number of attack targets and the attributes of one attack path are equal to the number of attack targets and the attributes of other attack paths; and a display control process for aggregating and displaying on a display device multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition.

[0108] (Supplementary Note 26) A recording medium storing the attack path display control program according to Supplementary Note 25, wherein the display control process displays, on the display device, information representing attack targets in the multiple attack paths that are aggregated and displayed on the display device.

[0109] (Appendix 27) A recording medium storing the attack path display control program described in Appendix 26, wherein the display control process displays on the display device either information that can identify attack targets in the multiple attack paths that is aggregated and displayed on the display device, or the number of attack targets in the multiple attack paths.

[0110] (Appendix 28) A recording medium storing the attack path display control program described in Appendix 26, wherein the display control process displays attack targets in the multiple attack paths that are aggregated and displayed on the display device in a display format that is different from attack targets in attack paths that are not aggregated and displayed on the display device.

[0111] (Supplementary Note 29) A recording medium storing the attack path display control program according to Supplementary Note 28, wherein the display mode represents any one of the shape, color, and background of an icon representing an attack target in the attack path.

[0112] (Supplementary Note 30) A recording medium storing an attack path display control program described in any one of Supplementary Notes 25 to 29, wherein the acquisition process acquires information representing the risk and information representing the implementation status of security measures that meet predetermined criteria regarding the target of attack on the attack path, and the determination process determines whether the information representing the risk and the information representing the implementation status meet the aggregation conditions according to the risk and the implementation status.

[0113] (Supplementary Note 31) A recording medium storing the attack path display control program described in Supplementary Note 30, wherein the aggregation condition indicates that the attack paths are aggregated and displayed on the display device regardless of whether the total values ​​of the values ​​representing the risk of the included attack targets are equal to each other, and indicates a method of displaying the type of security measure according to the total value.

[0114] (Supplementary Note 32) A recording medium storing the attack path display control program according to Supplementary Note 31, wherein the display control process displays on the display device the type of security measures implemented against the attack target included in the attack path with the highest total value among the plurality of attack paths.

[0115] (Supplementary Note 33) A recording medium storing the attack path display control program described in Supplementary Note 32, wherein the display control process displays, on the display device, the types of one or more security measures implemented against the attack target included in the attack path with the highest total value, if there are multiple attack paths with the highest total value among the multiple attack paths.

[0116] (Supplementary Note 34) A recording medium storing the attack path display control program described in Supplementary Note 33, wherein the display control process displays on the display device one or more types of security measures implemented against an attack target in at least one of the multiple attack paths.

[0117] (Supplementary Note 35) A recording medium storing the attack path display control program described in Supplementary Note 30, wherein the aggregation condition indicates that if the total values ​​representing the risk of the attack target in the multiple attack paths are different, the attack targets are aggregated and excluded from the targets to be displayed on the display device.

[0118] (Supplementary Note 36) A recording medium storing the attack path display control program described in Supplementary Note 30, wherein the aggregation condition indicates that if the types of security measures implemented against attack targets in the multiple attack paths are different, they are aggregated and excluded from targets to be displayed on the display device.

[0119] REFERENCE SIGNS LIST 10 Attack path display control device 11 Extraction unit 12 Acquisition unit 13 Determination unit 14 Display control unit 15 Storage unit 151 Information processing system configuration information 152 Attack path 153 Risk information 154 Attribute information 155 Countermeasure implementation status information 156 Aggregation conditions 20 Terminal device 21 Display screen 30 Attack path display control device 300 Information representing the configuration of the information processing system 31 Extraction unit 310 Attack path 32 Acquisition unit 320 Attribute 33 Determination unit 330 Aggregation conditions 34 Display control unit 40 Display device 900 Information processing device 901 CPU 902 ROM 903 RAM 904 Hard disk (storage device) 905 Communication interface 906 Bus 907 Recording medium 908 Reader / writer 909 Input / output interface

Claims

1. An attack path display control device comprising: an extraction means for extracting, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system; an acquisition means for acquiring information representing attributes of the attack targets in the attack paths that are related to the risk of the cyber attack being successful; a determination means for determining whether or not one of the multiple attack paths extracted by the extraction means satisfies an aggregation condition that represents that the number of attack targets and the attributes of one attack path are equal to the number of attack targets and the attributes of another attack path; and a display control means for aggregating multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition and displaying them on a display device.

2. The attack path display control device according to claim 1, wherein the display control means displays on the display device information representing the targets of attack in the plurality of attack paths that are aggregated and displayed on the display device.

3. The attack path display control device according to claim 2, wherein the display control means displays on the display device either information capable of identifying the targets of attack in the multiple attack paths that are aggregated and displayed on the display device, or the number of targets of attack in the multiple attack paths.

4. The attack path display control device described in claim 2, wherein the display control means displays the attack targets in the multiple attack paths that are aggregated and displayed on the display device in a display format that is different from the attack targets in the attack paths that are not aggregated and displayed on the display device.

5. The attack path display control device according to claim 4, wherein the display mode represents any one of the shape, color, and background of an icon representing the target of attack on the attack path.

6. An attack path display control device as described in claim 1 or claim 2, wherein the acquisition means acquires information representing the risk and information representing the implementation status of security measures that meet specified standards regarding the target of attack on the attack path, and the determination means determines whether the information representing the risk and the information representing the implementation status meet the aggregation conditions corresponding to the risk and the implementation status.

7. The attack path display control device described in claim 6, wherein the aggregation conditions indicate that the attack paths are aggregated and displayed on the display device regardless of whether the total values ​​of the values ​​representing the risk of the included attack targets are equal to each other, and indicate a display method for the type of security measures according to the total values.

8. The attack path display control device according to claim 7, wherein the display control means displays on the display device the type of security measures implemented against the target of attack included in the attack path with the highest total value among the multiple attack paths.

9. The attack path display control device according to claim 8, wherein, when there are multiple attack paths with the highest total value among the multiple attack paths, the display control means displays on the display device one or more types of security measures implemented against the attack target included in the attack path with the highest total value.

10. The attack path display control device according to claim 7, wherein the display control means displays on the display device one or more types of security measures implemented against the target of attack in at least one of the multiple attack paths.

11. The attack path display control device described in claim 6, wherein the aggregation condition indicates that if the total values ​​representing the risk of the attack target in the multiple attack paths are different, the target will be aggregated and excluded from the targets to be displayed on the display device.

12. The attack path display control device described in claim 6, wherein the aggregation condition indicates that if the types of security measures implemented against attack targets in the multiple attack paths are different, they will be aggregated and excluded from the targets to be displayed on the display device.

13. An attack path display control method using an information processing device, which extracts, from information representing the configuration of an information processing system, multiple attack paths from one attack target to other attack targets in a cyber attack against the information processing system, obtains information representing attributes of the attack targets in the attack paths that are related to the risk of the cyber attack being successful, determines whether or not each of the extracted attack paths satisfies an aggregation condition that represents that the number of attack targets and the attributes of one attack path are equal to the number of attack targets and the attributes of other attack paths, and aggregates and displays on a display device multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition.

14. The attack path display control method according to claim 13, further comprising the step of displaying on said display device information representing the targets of attack in said plurality of attack paths that are aggregated and displayed on said display device.

15. The attack path display control method according to claim 14, wherein either information capable of identifying the targets of attack in the plurality of attack paths that is aggregated and displayed on the display device, or the number of targets of attack in the plurality of attack paths is displayed on the display device.

16. An attack path display control method as described in claim 14, wherein the attack targets in the multiple attack paths that are aggregated and displayed on the display device are displayed on the display device in a different display format from the attack targets in the attack paths that are not aggregated and displayed on the display device.

17. A recording medium storing an attack path display control program for causing a computer to execute the following steps: an extraction process for extracting, from information representing the configuration of an information processing system, multiple attack paths leading from one attack target to other attack targets in a cyber attack against the information processing system; an acquisition process for acquiring information representing attributes related to the risk of the cyber attack succeeding for the attack targets included in the attack paths; a determination process for determining whether or not each of the multiple attack paths extracted by the extraction process satisfies an aggregation condition representing that the number of attack targets and the attributes of one attack path are equal to the number of attack targets and the attributes of other attack paths; and a display control process for aggregating and displaying on a display device multiple attack paths consisting of combinations of attack paths that satisfy the aggregation condition.

18. A recording medium storing the attack path display control program described in claim 17, wherein the display control process displays, on the display device, information representing the targets of attack in the multiple attack paths that are aggregated and displayed on the display device.

19. A recording medium storing the attack path display control program described in claim 18, wherein the display control process displays on the display device either information that can identify the targets of attack in the multiple attack paths that are aggregated and displayed on the display device, or the number of targets of attack in the multiple attack paths.

20. A recording medium storing the attack path display control program described in claim 18, wherein the display control process displays the attack targets in the multiple attack paths that are aggregated and displayed on the display device in a different display format from the attack targets in the attack paths that are not aggregated and displayed on the display device.

Images