Attack prediction system

Abstract

Provided is an attack prediction system capable of, when an attack on a target system is detected, predicting a potential attack that may occur next and the attack procedure with a small amount of manpower on the basis of cases of previous attacks and the attack procedures. An attack prediction system inputs attack information indicating the attack performed on the target system and system information indicating the specifications and state of the target system to artificial intelligence that has preliminarily learned attack case information that stores the cases of the attacks previously occurred and the attack procedures, and generates a potential attack that may occur after the attack indicated by the attack information and the attack procedure.

Description

Attack Prediction System

[0001] This disclosure relates to an attack prediction system.

[0002] The technology of Patent Document 1 analyzes whether an attack that has occurred corresponds to any of the attack scenarios that are predefined for the target system.

[0003] JP 2023-46923 A

[0004] The technology of Patent Document 1 requires that attack scenarios be defined in advance for a target system. However, there are a wide variety of common attacks and attack procedures, and new attacks and attack procedures are constantly being devised. Therefore, implementing security measures for a target system by taking into account the wide variety of common attacks and attack procedures that change from moment to moment requires a great deal of manpower, and there are limits to what humans can do.

[0005] Therefore, the object of the present disclosure is to provide an attack prediction system that, when an attack on a target system is detected, can predict the next attack and attack procedure that may occur with little manpower based on past examples of attacks and attack procedures.

[0006] The attack prediction system according to the present disclosure inputs attack information indicating attacks carried out on a target system and system information indicating the specifications and status of the target system into pre-trained artificial intelligence (AI) that stores attack case information that has accumulated examples of attacks and attack procedures that have occurred in the past, and generates attacks and attack procedures that may occur after the attacks indicated by the attack information.

[0007] According to the attack prediction system disclosed herein, when an attack on a target system is detected, information about the attack carried out on the target system and system information about the target system are input into an artificial intelligence that has previously learned attack case information that accumulates examples of attacks and attack procedures that have occurred in the past, thereby generating attacks and attack procedures that may occur after the attack in the attack information. Therefore, when an attack on the target system is detected, it is possible to predict the next attack and attack procedure that may occur on the target system based on the examples of past attacks and attack procedures with little manpower, and to take measures against the predicted attack and attack procedure.

[0008] FIG. 1 is a schematic configuration diagram of an attack prediction system according to embodiment 1. FIG. 2 is a diagram illustrating an example of a target system according to embodiment 1. FIG. 3 is a diagram illustrating an example of attack case information for learning according to embodiment 1. FIG. 4 is a diagram illustrating examples of attacks and attack procedures for learning according to embodiment 1. FIG. 5 is a diagram illustrating examples of generated attacks and attack procedures according to embodiment 1. FIG. 6 is a flowchart for explaining the processing of the attack prediction system according to embodiment 1. FIG. 7 is a diagram illustrating a schematic hardware configuration of each information processing device according to embodiment 1.

[0009] 1. First Embodiment An attack prediction system 1 according to a first embodiment will be described with reference to the drawings. FIG. 1 shows a schematic configuration diagram of the attack prediction system 1.

[0010] 1-1. General Configuration of Attack Prediction System 1 In this embodiment, the attack prediction system 1 is provided as being divided into a target system 10 and an attack prediction device 12 connected to the target system 10 so as to be able to communicate with it.

[0011] The target system 10 includes an attack detection unit 31, a system information acquisition unit 32, an external environment information acquisition unit 33, and a system update unit 34. When the target system 10 is made up of multiple devices, the functional units 31 to 34 may be provided in a management device that manages the target system 10, or may be provided in each of multiple devices that can be installed.

[0012] The attack prediction device 12 includes an attack case information acquisition unit 35, an attack prediction unit 36, a prediction result evaluation unit 37, a security function extraction unit 38, and a security function modification unit 39. The attack prediction device 12 is provided in an information processing device such as a server that is communicatively connected to the target system 10. The attack prediction device 12 may perform processing on a plurality of target systems 10. Note that the functional units 35 to 39 may be provided in each target system 10.

[0013] <Target System 10> The target system 10 is a system composed of one device or a system in which multiple devices are connected for communication. For example, when the target system 10 is composed of multiple devices, the multiple devices are composed of various devices such as an external communication device (communication I / F) that communicates with the outside of the system, an internal communication device (communication I / F) and internal communication line that communicates within the system, an information processing device, a control device, a sensor device, and an actuator.

[0014] For example, as shown in Figure 2, the target system 10 is an in-vehicle system in which multiple devices mounted on a vehicle are communicatively connected. In this case, the external communication devices include wireless communication devices that perform wireless communication with external devices using various communication protocols (e.g., cellular communication, Wi-Fi, BLE (Bluetooth Low Energy)), and wired communication devices that perform wired communication with external devices using various communication protocols (e.g., USB, CAN (Controller Area Network)). The internal communication devices and internal communication lines include a gateway device that interconnects multiple communications using different communication protocols, and multiple internal communication lines that communicate between multiple devices using a communication protocol. CAN, Ethernet, FlexRay, LIN (Local Interconnect Network), etc. are used as communication protocols.

[0015] Furthermore, the information processing device may include a navigation device and a driving assistance device. The control device may include an electric steering control device that controls an electric steering device, an electric braking control device that controls an electric braking device, a drive control device that controls a drive power source for the wheels (e.g., a motor, an engine), a light control device that controls the drive of lights such as headlights, etc. The sensor device may include a surroundings monitoring device such as a camera and a radar, and a vehicle state detection device consisting of multiple sensors that detect the running state of the vehicle, etc. The actuators may include lights such as headlights, a motor for the electric steering device, a motor for the electric braking device, a motor for driving the wheels, and various actuators for the engine.

[0016] The target system 10 may be a monitoring system including multiple roadside devices installed outside a vehicle that monitor roads. Alternatively, the target system 10 does not have to be configured from multiple devices, but may be configured from multiple virtual machines or multiple container software programs running on a single information processing device. The single information processing device includes an external communication device (communication I / F) that communicates with the outside. In this case, each device described below is replaced with each virtual machine or each container software program.

[0017] <Attack Prediction Device 12> As described above, the attack prediction device 12 is provided in an information processing device such as a server that is communicatively connected to the target system 10. As will be described later, the attack prediction device 12 is provided in an information processing device with a large amount of resources in order to operate artificial intelligence.

[0018] For example, if the target system 10 is an in-vehicle system, the attack prediction device 12 is connected to the wireless communication device of the in-vehicle system via wireless communication, and is connected to each device (information processing device, control device, sensor device, and actuator) via an internal communication device and an internal communication line.

[0019] The functions of the attack prediction device 12 may be incorporated into the target system 10. For example, it may be incorporated into an information processing device of the target system 10 that has a large amount of resources. Alternatively, if the target system 10 is configured by multiple virtual machines or multiple container software programs running on a single information processing device, the functions of the attack prediction device 12 may be incorporated as virtual machines or container software programs.

[0020] 1-2. Functional Units of the Target System 10 As described above, the target system 10 includes the attack detection unit 31, the system information acquisition unit 32, the external environment information acquisition unit 33, and the system update unit .

[0021] <Attack Detection Unit 31> The attack detection unit 31 detects attacks made on the target system 10 and transmits attack information indicating the detected attacks to the attack prediction unit 36. For example, the attack detection unit 31 detects attacks that have occurred on the target system 10 (for example, attack methods described in attack case information) or a series of attacks. When the attack detection unit 31 detects an attack, it retains and transmits information for identifying the attack. For example, this information includes information such as the attacked device, attack details, attack procedures, and attack time. When a communication packet is received from an unauthorized communication source, the attack detection unit 31 retains at least the reception timestamp, the sender address, etc.

[0022] Alternatively, when the target system 10 is composed of a virtual machine or container software and a system call that is not specified in the specifications is issued, at least the timestamp when the system call was issued or detected, the issuer of the system call, the issued system call, and the arguments of the system call are retained and transmitted.

[0023] The attack detection unit 31 may be provided in each device of the target system 10 that can be installed, or may be provided in a specific device (a central information processing device) of the target system 10. The attack detection unit 31 is provided as software for the device.

[0024] <System Information Acquisition Unit 32> The system information acquisition unit 32 acquires system information indicating the specifications and status of the target system 10 and transmits the acquired system information to the attack prediction unit 36. The system information includes the functions, specifications, and operating status of each device constituting the target system 10, the connection relationships, connection methods, and communication status of multiple devices, and data held by each device. If the device is an information processing device, the functions, specifications, and operating status of the device include hardware information (resource amounts and resource usage status of processing units such as CPUs, memory, and other hardware) and software information (functions, specifications, and operating status of running software). The connection relationships and connection methods include communication lines and communication protocols, etc. The communication status includes the data traffic volume of each communication line and information on the source and destination of each communication line, etc. The data held by each device includes valuable asset data that may be the target of an attack (e.g., communication messages, firmware, configuration files, encryption keys, electronic signatures, electronic certificates), etc.

[0025] Alternatively, if the target system 10 is composed of virtual machines or container software, it includes the functions, specifications, and operating status of each virtual machine, the connection relationships, connection methods, and communication status of multiple virtual machines, and the retained data of each virtual machine.

[0026] The system information acquisition unit 32 may be provided in each device of the target system 10 that can be installed, or may be provided in a specific device (a central information processing device) of the target system 10. The system information acquisition unit 32 is provided as software for the device.

[0027] <External environment information acquisition unit 33> The external environment information acquisition unit 33 acquires external environment information of the target system 10 and transmits the acquired external environment information to the attack prediction unit 36. The external environment information includes various environmental conditions surrounding the target system 10. For example, the external environment information includes the physical environmental conditions around the target system 10, the communication state between the target system 10 and external devices, and user information using the target system 10. This external environment information is acquired from information detected or acquired by the target system 10.

[0028] For example, if the target system 10 is an in-vehicle system, the physical environmental conditions include the location information (latitude, longitude, altitude, country) of the target system 10, roadside devices, other vehicles, buildings, weather, road conditions, etc. that exist around the target system 10. The communication conditions include the congestion and stability of communications with the outside, information on external devices connected to the target system 10, etc. The user information includes information on the occupants, operation and setting information by the occupants, etc. Note that other information on the external environment may be used as long as it is effective for generating attacks and attack procedures in the attack prediction unit 36.

[0029] The external environment information acquisition unit 33 may be provided in each device of the target system 10 that can be installed, or may be provided in a specific device (a central information processing device) of the target system 10. The external environment information acquisition unit 33 is provided as software of the device.

[0030] 1-3. Functional Units of the Attack Prediction Device 12 As described above, the attack prediction device 12 includes the attack case information acquisition unit 35, the attack prediction unit 36, the prediction result evaluation unit 37, the security function extraction unit 38, and the security function modification unit 39.

[0031] <Attack Case Information Acquisition Unit 35 > The attack case information acquisition unit 35 acquires attack case information that accumulates past attacks and attack procedure cases, and transmits the acquired attack case information to the attack prediction unit 36 ​​.

[0032] For example, the attack case information includes attacks or attack procedures that have occurred in the past against the target system 10, previous models of the target system 10, systems similar to the target system 10, etc. The attack case information also includes information that associates attacks with attack procedures based on kill chains in databases such as ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) and CVE (Common Vulnerabilities and Exposures), or information linking attacks with attacks or attacks with vulnerabilities. This attack case information may include system information, external environment information, etc.

[0033] For example, after a port scan attack, the running services on available ports may be checked, or malicious messages may be sent. Since one attack can lead to various other attacks, information relating these attacks is obtained.

[0034] For example, as shown in Figure 3, information is acquired that associates the process name of a kill chain, the attack method for realizing each kill chain, and the kill chain candidate to be performed after each attack method. In Figure 3, the ID of the next kill chain candidate corresponds to the process ID of the kill chain on the left. For example, after a port scan, which is an attack method with ID = 1, the next kill chain candidates will be ID = 1, 2, 3, 4, and 5, and various attacks can occur.

[0035] Figure 4 shows an example of the attack and the attack procedure that can be obtained. There are multiple attacks in the following attack procedure, but the attack procedure on the far left is explained below. - Identify open services by port scanning the device. - Then, exploit the firmware update function from the open service and attempt signature verification by exploiting a vulnerability related to signature verification. By bypassing the signature verification, the firmware is rewritten with malicious code. - Then, by executing the malicious code, a backdoor is installed, enabling remote operation. - Then, send a malicious message remotely to the device.

[0036] <Attack Prediction Unit 36> The attack prediction unit 36 ​​causes the artificial intelligence to learn in advance attack case information, which is acquired from the attack case information acquisition unit 35 and is an accumulation of past attack cases and attack procedures. Artificial intelligence is a broad concept that includes generative AI. The artificial intelligence and generative AI are configured using neural networks and the like. Various learning methods, such as machine learning, are used as the learning method.

[0037] The attack prediction unit 36 ​​inputs attack information indicating an attack carried out on the target system 10, obtained from the attack detection unit 31, and system information indicating the specifications and status of the target system 10, obtained from the system information acquisition unit 32, into the trained artificial intelligence, and generates attacks and attack procedures that may occur after the attack indicated in the attack information. The attack prediction unit 36 ​​may also generate threats and damages that may result from the attacks and attack procedures. That is, the attack prediction unit 36 ​​may generate an attack scenario that includes attacks, attack procedures, threats, and damages.

[0038] For example, an artificial intelligence (e.g., a generation AI) has the ability to process natural language and generates an answer to a natural language input. For example, if the generation AI is input with "Please tell me the attacks and attack procedures that may occur after an attack with attack information B is carried out against a system with system information A," the generation AI will output the attacks and attack procedures that may occur. Note that various input formats that can be discerned by the artificial intelligence, such as semi-formal languages ​​or formal languages, may be used as input to the artificial intelligence.

[0039] According to this configuration, when an attack on the target system 10 is detected, attack information on the target system 10 and system information on the target system 10 can be input into artificial intelligence that has previously learned attack case information that accumulates examples of attacks and attack procedures that have occurred in the past, thereby generating attacks and attack procedures that may occur after the attack in the attack information. Therefore, when an attack on the target system 10 is detected, it is possible to predict with little manpower the next attack and attack procedure that may occur on the target system 10 based on past examples of attacks and attack procedures, and to take measures against the predicted attack and attack procedure.

[0040] For example, Figure 5 shows an example of an attack and attack procedure that is generated when the attack detection unit 31 detects a port scan of the driving assistance device and the port scan of the driving assistance device and system information of the in-vehicle system are input into the artificial intelligence. Multiple attacks are generated in the following attack procedure, but the attack procedure on the far left is described below. - Identify an open service by port scanning the driving assistance device. - Then, exploit the firmware update function of the driving assistance device from the open service and attempt signature verification by exploiting a vulnerability related to signature verification. By bypassing the signature verification, the firmware of the driving assistance device is rewritten with malicious code. - Then, execute the malicious code to install a backdoor, allowing the driving assistance device to be remotely operated. - Then, send a malicious message remotely to the driving assistance device.

[0041] The attack prediction unit 36 ​​further inputs the external environment information of the target system 10 to the artificial intelligence. For example, if the generation AI is input with a command such as "Please tell me the attacks and attack procedures that may occur after an attack with attack information B is carried out on a system with system information A under an environment with external environment information C," the generation AI will output the attacks and attack procedures that may occur. Note that various input formats that can be discerned by the artificial intelligence, such as semi-formal languages ​​or formal languages, may be used as input to the artificial intelligence.

[0042] According to this configuration, by inputting external environment information that changes from moment to moment, attacks and attack procedures that are suitable for the external environment information are generated, and attacks and attack procedures that are not suitable for the external environment information are not generated, thereby reducing the time spent considering the impact and validity of unnecessary attacks and attack procedures.

[0043] For example, if the vehicle's driving assistance function is not activated by the driver's operation, attacks and attack procedures related to the driving assistance function will not be generated. If the surroundings are bright, the headlights will be turned off, so attacks and attack procedures related to the headlight off operation will not be generated.

[0044] <Prediction Result Evaluation Unit 37> The prediction result evaluation unit 37 evaluates the degree of impact on the target system 10 of the attacks and attack procedures generated by the attack prediction unit 36, and the likelihood of the generated attacks and attack procedures occurring.

[0045] In the evaluation, one or both of system information and external environment information of the target system 10 are used. Based on the evaluation results of the impact and likelihood of occurrence, it can be determined whether or not to deal with the attack and attack procedure. For example, it can be determined that attacks and attack procedures with high impact and likelihood of occurrence should be dealt with preferentially, and attacks and attack procedures with low impact and likelihood of occurrence should not be dealt with.

[0046] Furthermore, the prediction result evaluation unit 37 evaluates the consistency of the generated attacks and attack procedures with the target system 10. Furthermore, the prediction result evaluation unit 37 evaluates the consistency of the generated attacks and attack procedures with external environment information. With this configuration, it is possible to exclude attacks and attack procedures that are inconsistent with the target system 10 and external environment information based on the evaluation result of the consistency between the target system 10 and external environment information.

[0047] An example of evaluation using system information will be described. Attacks and attack procedures related to communication I / Fs or software that are not provided in the device or system are eliminated because they do not need to be generated in the first place. Devices that do not have external communication devices are unlikely to be exposed to attacks other than physical attacks, so the likelihood of attacks and attack procedures that use external communication devices is reduced.

[0048] The impact level is changed according to the resource usage status of the device. For example, if the processing load of the device is high, there is a high possibility that an attack will cause abnormal behavior, so the impact level of attacks and attack procedures on that device is increased. The impact level of attacks on the security attributes (confidentiality, integrity, availability) of functions or data is evaluated. The impact level of attacks and attack procedures on important functions or data is increased.

[0049] Next, an example of evaluation using external environment information will be described. If the vehicle is passing through a tunnel, attacks and attack procedures using communication means that cannot be used inside the tunnel are excluded. If no objects such as people are detected inside or around the vehicle, physical attacks and attack procedures against objects are excluded.

[0050] In areas near unstable situations, the attack probability assessment value is high because there is a high possibility that attacked devices will be exploited. In areas where communication is congested or unstable, communication bandwidth cannot be secured, making it difficult for DoS attacks using wireless communication to occur, or even if they do occur, the impact is small, so the probability of a DoS attack occurring is low.

[0051] If the road is congested, the impact of the attack procedure, which may cause abnormal vehicle behavior, is increased.

[0052] The evaluation by the prediction result evaluation unit 37 may be performed by rule-based judgment. Alternatively, the AI ​​may learn past cases of attacks and attack procedures in the learning data for the AI ​​by incorporating system information and external environment information at that time, and in addition to generating attacks and attack procedures, output the impact, likelihood of occurrence, and consistency of each generated attack and attack procedure to the AI.

[0053] <Security Function Extraction Unit 38> The security function extraction unit 38 generates candidate security functions that deal with the generated attacks and attack procedures. With this configuration, candidate security functions that deal with the generated attacks and attack procedures can be efficiently generated.

[0054] The security function extraction unit 38 generates candidate security functions for each device that deal with each attack and attack procedure based on each attack and attack procedure and system information. The candidate security functions include enabling or executing existing security functions installed in the device or system, disabling functions installed in the device or system (for example, making a communication interface that is publicly accessible private), installing new security functions that are not currently installed in the device or system but can mitigate the impact of attacks, adjusting parameters of existing security functions, changing the execution priority of existing security functions, and changing the placement of existing security functions.

[0055] The generation of security function candidates may be performed by referencing a database in which attacks corresponding to each device are associated with security functions that are effective against them, and extracting security functions that correspond to the generated attacks, attack procedures, and system information. Alternatively, the database in which attacks corresponding to each device are associated with security functions that are effective against them may be trained on an artificial intelligence, and the generated attacks, attack procedures, and system information may be input to the artificial intelligence, which may then output security functions that deal with each attack and attack procedure.

[0056] <Security Function Modification Unit 39> The security function modification unit 39 determines the modification details of the security functions of the target system 10 based on the generated security function candidates, and communicates the determined security function modification details to the target system 10. With this configuration, security functions against attacks and attack procedures can be efficiently constructed based on the generated security function candidates.

[0057] For example, the security function modification unit 39 preferentially selects security functions that address attacks and attack procedures with high impact and likelihood from the generated security function candidates, and transmits a command to change to the selected security function to the target system 10. For example, security functions that address attacks and attack procedures with impact and likelihood equal to or greater than a determination value are selected. Before transmitting the selection to the target system 10, the administrator may be asked to approve and correct the selection, or the selection may be automatically distributed to the target system 10 without the administrator's approval. Alternatively, the security function modification unit 39 may have the administrator select a security function from the generated security function candidates, and transmit a command to the target system 10 to change to the selected security function. The content of the change specifies the device of the target system 10 whose security function is to be changed.

[0058] <System update unit 34 of target system 10> The system update unit 34 of the target system 10 changes the security functions of the target system 10 based on the changes to the security functions transmitted from the security function change unit 39. With this configuration, the security functions can be changed efficiently based on the changes to the security functions.

[0059] For example, if the changes include enabling or executing an existing security function, the system update unit 34 enables or executes the specified existing security function. If the changes include disabling a function of the device or system (for example, making a communication interface that is publicly available private), the system update unit 34 disables the specified function. If the changes include adding a new security function, the new security function is added. Software for the new security function is acquired from the attack prediction device 12 or the like. If the changes include adjusting parameters of an existing security function, the system update unit 34 adjusts the specified parameters. If the changes include changing the execution priority of an existing security function, the system update unit 34 changes the specified execution priority. If the changes include changing the placement of an existing security function, the system update unit 34 changes the specified placement.

[0060] The system update unit 34 may be provided in each device of the target system 10 that can be installed, or may be provided in a specific device (a central information processing device) of the target system 10. The system update unit 34 is provided as software for the device.

[0061] <Flowchart> A schematic process of the attack prediction system 1 will be described with reference to the flowchart in Fig. 6. In step S01, if the attack detection unit 31 of the target system 10 detects an attack on the target system 10, the process proceeds to step S02. In step S02, as described above, the attack detection unit 31 transmits attack information indicating the detected attack to the attack prediction unit 36.

[0062] In step S03, as described above, the system information acquisition unit 32 of the target system 10 acquires system information indicating the specifications and status of the target system 10, and transmits the acquired system information to the attack prediction unit 36.

[0063] In step S04, as described above, the external environment information acquisition unit 33 of the target system 10 acquires the external environment information of the target system 10 and transmits the acquired external environment information to the attack prediction unit 36.

[0064] In step S05, as described above, the attack prediction unit 36 ​​of the attack prediction device 12 inputs the attack information obtained from the attack detection unit 31, which indicates the attack carried out on the target system, and the system information obtained from the system information acquisition unit 32, which indicates the specifications and status of the target system 10, into the trained artificial intelligence, and generates attacks and attack procedures that may occur after the attack indicated by the attack information.

[0065] The attack prediction unit 36 ​​has the artificial intelligence learn in advance the attack case information, which is an accumulation of past attack cases and attack procedure cases acquired from the attack case information acquisition unit 35. The attack prediction unit 36 ​​may have the artificial intelligence learn the attack case information after the attack information is transmitted from the attack detection unit 31.

[0066] In step S06, as described above, the prediction result evaluation unit 37 of the attack prediction device 12 evaluates the impact on the target system 10 of the attacks and attack procedures generated by the attack prediction unit 36, and the likelihood of the generated attacks and attack procedures occurring.

[0067] In step S07, as described above, the security function extraction unit 38 of the attack prediction device 12 generates candidates for security functions that deal with the generated attack and attack procedure.

[0068] In step S08, as described above, the security function modification unit 39 of the attack prediction device 12 determines the changes to the security functions of the target system 10 based on the generated security function candidates, and transmits the determined changes to the security functions to the target system 10.

[0069] In step S09 , as described above, the system update unit 34 of the target system 10 modifies the security functions of the target system 10 based on the modification details of the security functions transmitted from the security function modification unit 39 .

[0070] <Example of Information Processing Device> As shown in FIG. 7 , the information processing devices, such as the attack prediction device 12 and the information processing device and control device of the target system 10, include an arithmetic processing device 80, a storage device 81, and a communication device 82. Various types of arithmetic processing devices, such as a central processing unit (CPU), various integrated circuits (ICs), field programmable gate arrays (FPGAs), graphics processing units (GPUs), and various artificial intelligence (AI) chips, are used as the arithmetic processing device 80. Various types of volatile memories and non-volatile memories are used as the storage device 81. The storage device 81 may be provided inside the arithmetic processing device 80. The communication device 82 is a wired communication device or a wireless communication device, and communicates with connected devices. Each function of the information processing unit is realized by cooperation between the hardware components, such as the arithmetic processing device 80, the storage device 81, and the communication device 82. When a CPU is used as the arithmetic processing device 80, each function is realized by the CPU executing a program stored in the storage device 81.

[0071] Although exemplary embodiments are described in the present disclosure, the various features, aspects, and functions described in the embodiments are not limited to the application of a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless variations not illustrated are anticipated within the scope of the technology disclosed in the specification. For example, variations in, addition to, or omission of at least one component are included.

[0072] 1: Attack prediction system, 10: Target system, 12: Attack prediction device, 31: Attack detection unit, 32: System information acquisition unit, 33: External environment information acquisition unit, 34: System update unit, 35: Attack case information acquisition unit, 36: Attack prediction unit, 37: Prediction result evaluation unit, 38: Security function extraction unit, 39: Security function modification unit

Claims

1. An attack prediction system that inputs attack information indicating attacks carried out on a target system and system information indicating the specifications and status of said target system into pre-trained artificial intelligence (AI) that stores attack case information that has accumulated examples of attacks and attack procedures that have occurred in the past, and generates attacks and attack procedures that may occur after the attack in the attack information.

2. The attack prediction system according to claim 1, wherein external environmental information of the target system is further input to the artificial intelligence.

3. An attack prediction system according to claim 1 or 2, which evaluates the impact of the generated attacks and attack procedures on the target system, and the likelihood of the generated attacks and attack procedures occurring.

4. An attack prediction system according to claim 1 or 2, which evaluates the consistency between the generated attacks and attack procedures and the target system.

5. The attack prediction system according to claim 2, which evaluates the consistency of the generated attacks and attack procedures with the target system and the external environment information.

6. An attack prediction system as described in claim 1 or 2, which generates candidate security functions to deal with the generated attacks and attack procedures, determines changes to the security functions of the target system based on the generated candidate security functions, and communicates the determined changes to the security functions to the target system.

7. The attack prediction system according to claim 6, wherein the security functions of the target system are changed based on the transmitted changes to the security functions.

Images