Security countermeasure action determination method, security countermeasure action determination device, and program

Abstract

This security countermeasure action determination method includes: a step for reading a security action list including a plurality of sets of a security action and an execution condition when executing the security action; a step for acquiring information related to a security incident; a step for determining a security action to be executed from among security actions each having an execution condition satisfied by the information related to the security incident, on the basis of at least one of (i) whether or not the security action can be simultaneously executed, (ii) the number of conditions included in the execution condition, and (iii) a range of the conditions included in the execution condition; and a step for outputting the security action.

Description

Security response action determination method, security response action determination device, and program

[0001] The present disclosure relates to a security response action determination method, a security response action determination device, and a program.

[0002] In recent years, as various devices, such as office equipment, factory equipment, and control systems for automobiles, become increasingly connected to the Internet of Things (IoT), the methods of cyberattacks targeting such IoT devices have become more diverse. There is a demand for automating responses to various attacks. In other words, attempts have been made to prepare response actions (security actions) in advance for various attack methods, and to select and execute appropriate response actions based on rules in response to the attack. A technique such as that shown in Patent Document 1 is known as a rule-based selection method.

[0003] JP 2015-118449 A

[0004] When selecting a response action against a cyber-attack, if a selection is made based on rules as shown in Patent Literature 1, an appropriate response action may not be selected. In other words, a method for determining a response action based on a more appropriate selection is required. Therefore, an object of the present disclosure is to provide a security response action determination method and the like that can determine a more appropriate response action.

[0005] A security response action determination method according to one aspect of the present disclosure is a computer-based security response action determination method for determining a security action in response to a security incident that has occurred, the method including the steps of: reading out a security action list stored in a memory unit, the security action list including multiple pairs of security actions and execution conditions for executing the security actions; acquiring information about the security incident that has occurred; and determining the security action to be executed from among the security actions in the security action list for which the information about the security incident that has occurred satisfies the execution conditions, the step of determining the security action to be executed based on at least one of (i) whether each of the security actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the security actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the security actions; and outputting the determined security action.

[0006] In addition, a security response action determination device according to one aspect of the present disclosure is a security response action determination device that determines a security action in response to a security incident when the security incident occurs, and includes: a memory unit that stores a security action list including multiple pairs of security actions and execution conditions for executing the security actions; an acquisition unit that acquires information related to the security incident that has occurred; a step of determining the security action to be executed from among the security actions in the security action list for which the information related to the security incident that has occurred satisfies the execution conditions, the step including: a determination unit that determines the security action to be executed based on at least one of (i) whether each of the security actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the security actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the security actions; and an output unit that outputs the determined security action.

[0007] Furthermore, a program according to one aspect of the present disclosure is a program for causing a computer to execute the security response action determination method described above.

[0008] According to the present disclosure, it is possible to determine more appropriate response actions.

[0009] FIG. 1 is a diagram illustrating an overall configuration of a security response system according to an embodiment. FIG. 2 is a diagram illustrating a configuration of a security response action determination device according to an embodiment. FIG. 3 is a diagram illustrating information related to a security incident according to an embodiment. FIG. 4 is a diagram illustrating multiple security action lists according to an embodiment. FIG. 5 is a diagram illustrating multiple security action lists according to an embodiment. FIG. 6 is a diagram illustrating multiple security action lists according to an embodiment. FIG. 7 is a diagram illustrating multiple security action lists according to an embodiment. FIG. 8 is a diagram illustrating multiple security action lists according to an embodiment. FIG. 9 is a sequence diagram illustrating an example of operation of a security response system according to an embodiment. FIG. 10 is a flowchart illustrating an example of operation of a security response action determination device according to an embodiment. FIG. 11 is a flowchart illustrating an example of operation of a security response action determination device according to an embodiment. FIG. 12 is a flowchart illustrating an example of operation of a security response action determination device according to an embodiment. FIG. 13 is a flowchart illustrating an example of operation of a security response action determination device according to an embodiment. FIG. 14 is a flowchart illustrating an example of operation of a security response action determination device according to an embodiment. FIG. 15 is a flowchart illustrating an example of operation of a security response action determination device according to an embodiment. Fig. 16 is a diagram for explaining a determination based on the possibility of simultaneous execution according to an embodiment. Fig. 17 is a diagram for explaining a determination based on the range of execution conditions according to an embodiment. Fig. 18 is a diagram for explaining a determination based on the range of execution conditions according to an embodiment.

[0010] (Knowledge Forming the Basis of the Present Disclosure) As various devices, such as office equipment, factory facilities, and control systems for automobiles, are increasingly being connected to the Internet, the risk of cyberattacks targeting such IoT devices is increasing, and the methods of such attacks are also diversifying. Currently, security response personnel select response actions against cyberattacks, but in many cases, the supply of personnel cannot keep up with the speed of diversifying attacks, resulting in a shortage of personnel. Therefore, technology has been developed that automatically selects, determines, and executes pre-prepared response actions against cyberattacks. This automation technology, also known as a SOAR (Security Orchestration, Automation, and Response) system, is expected to help resolve the shortage of personnel.

[0011] In the SOAR system, in response to a cyberattack, an appropriate response action is selected based on rules from multiple prepared response actions and determined as the action to be executed.The determined response action is then automatically executed, making it possible to respond to cyberattacks on devices without the need for a responder.

[0012] On the other hand, when selecting an appropriate response action from multiple response actions based on rules, for example, techniques such as those disclosed in Patent Literature 1, which are known as rule-based selection methods, have issues, particularly when applied to selecting response actions in a SOAR system. Specifically, since multiple response actions may be selected in response to a certain cyber attack, no solution is provided for determining which response is appropriate: whether to execute all of the multiple response actions, to execute one of them selectively, or to execute none of them. Therefore, the present disclosure provides a security response action determination method and the like to solve the above problems.

[0013] In order to achieve the above, a security response action determination method according to a first aspect of the present disclosure is a computer-based security response action determination method for determining a security action (response action) in response to a security incident that occurs, the method including the steps of reading out a security action list stored in a memory unit, the security action list including multiple pairs of security actions and execution conditions for executing the security actions; acquiring information about the security incident that has occurred; and determining a security action to be executed from among the security actions in the security action list for which the information about the security incident that has occurred satisfies the execution conditions, the step of determining the security action to be executed based on at least one of (i) whether each of the security actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the security actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the security actions; and outputting the determined security action.

[0014] This makes it possible to determine which security actions to execute based on at least one of (i) whether each of the security actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the security actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the security actions. Therefore, even if there are multiple security actions included in the security action list that satisfy the execution conditions, it is possible to determine whether all of the multiple security actions should be executed, whether one of the multiple security actions should be selectively executed, or whether none of the multiple security actions should be executed, based on at least one of (i), (ii), and (iii) above, thereby making it possible to determine more appropriate security actions.

[0015] Furthermore, a security response action determination method according to a second aspect of the present disclosure is the security response action determination method described in the first aspect, wherein the memory unit stores multiple security action lists corresponding to each system (type) to be monitored, and in the reading step, a security action list corresponding to the system (type) in which the security incident occurred is read out of the multiple security action lists based on information regarding the security incident that occurred.

[0016] This allows a security action list to be created for each type of system to be monitored. Furthermore, the configuration other than the security action list can be used in common regardless of the type of system to be monitored. In other words, a single processing device (security response action determination device) can determine security actions for multiple types of systems to be monitored.

[0017] Furthermore, a security response action determination method according to a third aspect of the present disclosure is the security response action determination method described in the first or second aspect, and in the determination step, security action candidates are extracted from the security action list, which are security actions for which information regarding the security incident that has occurred satisfies an execution condition, and a security action to be executed is determined from the extracted security action candidates based on at least one of (i), (ii), and (iii).

[0018] According to this, security actions that satisfy the execution conditions are extracted as candidate security actions, and from among the extracted candidate security actions, a security action to be executed can be determined based on (i), (ii), and (iii).

[0019] In addition, a security response action determination method according to a fourth aspect of the present disclosure is the security response action determination method described in the third aspect, and in the determination step, two or more security action candidates corresponding to the same security action among the extracted security action candidates are treated as one security action candidate.

[0020] According to this, when the same security action is included among the extracted security action candidates, these are treated as one security action candidate, and the security action to be executed can be determined from among them.

[0021] Furthermore, a security response action determination method according to a fifth aspect of the present disclosure is a security response action determination method according to the third or fourth aspect, in which in the determination step, a security action to be executed is determined based on at least one of (i), (ii), and (iii) from among two or more security action candidates that correspond to non-identical security actions among the extracted security action candidates.

[0022] This allows a security action to be determined based on (i), (ii), and (iii) from two or more candidate security actions corresponding to non-identical security actions.

[0023] Furthermore, a security response action determination method according to a sixth aspect of the present disclosure is a security response action determination method described in any one of the first to fifth aspects, wherein in the determination step, if one of the security actions that can be executed simultaneously is determined as the security action to be executed based on (i) from among the security actions that satisfy the execution conditions, the other is also determined as the security action to be executed.

[0024] According to this, when one of the security actions that can be executed simultaneously among the security actions that satisfy the execution conditions is determined by the judgment based on (i), the other is also determined as the security action to be executed, so that these security actions can be executed simultaneously.

[0025] Furthermore, a security response action determination method according to a seventh aspect of the present disclosure is a security response action determination method described in any one of the first to sixth aspects, in which in the determination step, from among the security actions that satisfy the execution conditions, a security action that has the largest number of conditions included in the execution conditions corresponding to each of the security actions is determined to be the security action to be executed based on (ii).

[0026] According to this, by the determination based on (ii), it is possible to execute the security action that has the largest number of conditions included in the execution conditions corresponding to each security action from among the security actions that satisfy the execution conditions.

[0027] Furthermore, a security response action determination method according to an eighth aspect of the present disclosure is a security response action determination method described in any one of the first to seventh aspects, wherein in the determination step, from among the security actions that satisfy the execution conditions, a security action that has the narrowest range of conditions included in the execution conditions corresponding to each security action is determined based on (iii).

[0028] According to this, by the determination based on (iii), it is possible to execute the security action that has the narrowest range of conditions included in the execution conditions corresponding to each security action from among the security actions that satisfy the execution conditions.

[0029] Furthermore, a security response action determination method according to a ninth aspect of the present disclosure is a security response action determination method described in any one of the first to eighth aspects, in which in the determination step, a determination based on (i) is made, and then a determination based on (ii) and (iii) is made.

[0030] According to this, security actions that can be executed simultaneously can be treated as a single security action by the determination based on (i), and then the security actions to be executed can be determined by the determination based on (ii) and (iii). Alternatively, after it has been confirmed by the determination based on (i) that there are no security actions that can be executed simultaneously, the security actions to be executed can be determined by the determination based on at least one of (ii) and (iii).

[0031] Furthermore, a security response action determination method according to a tenth aspect of the present disclosure is the security response action determination method described in the ninth aspect, and in the determination step, from among the security actions that satisfy the execution conditions, a security action that satisfies at least one of the following is executed: the security action that is determined to have the largest number of conditions included in the corresponding execution conditions in the determination based on (ii) and the security action that is determined to have the narrowest range of conditions included in the corresponding execution conditions in the determination based on (iii) is executed among the security actions that are determined to be unable to be executed simultaneously in the determination based on (i).

[0032] According to this, security actions that are determined to be incapable of simultaneous execution can be compared from at least one of the perspectives of whether the number of conditions included in the corresponding execution conditions is determined to be the largest in the determination based on (ii) or whether the range of conditions included in the corresponding execution conditions is determined to be the narrowest in the determination based on (iii), and it can be determined which of them to execute.

[0033] In addition, a security response action determination device according to an eleventh aspect of the present disclosure is a security response action determination device that determines a security action in response to a security incident when the security incident occurs, and includes: a memory unit that stores a security action list including multiple pairs of security actions and execution conditions for executing the security actions; an acquisition unit that acquires information related to the security incident that has occurred; a step of determining a security action to be executed from among the security actions in the security action list for which the information related to the security incident that has occurred satisfies the execution conditions, the step including a determination unit that determines the security action to be executed based on at least one of (i) whether each of the security actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the security actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the security actions; and an output unit that outputs the determined security action.

[0034] This can achieve the same effects as the security response action determination method described above.

[0035] A program according to a twelfth aspect of the present disclosure is a program for causing a computer to execute the security response action determination method according to any one of the first to tenth aspects.

[0036] By executing this method on a computer, it is possible to achieve the same effects as the security response action determination method described above.

[0037] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Each of the embodiments described below represents a specific example of the present disclosure. The numerical values, shapes, components, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not recited in independent claims are described as optional components. Furthermore, the respective contents of all the embodiments and alternative examples can be combined.

[0038] In addition, the same reference numerals are used for the same components in each drawing.

[0039] Furthermore, in this specification, when a comparison is made, for example, with "above a threshold" or "below a threshold," it means that the distinction is made at the threshold, and may mean "greater than the threshold" or "below the threshold," respectively.

[0040] Furthermore, the numerical values ​​of the thresholds and the like in the present embodiment are merely examples, and other numerical values ​​may be used.

[0041] (Embodiment) [Overall Configuration] FIG. 1 is a diagram showing the overall configuration of a security response system according to an embodiment.

[0042] The security response system is composed of two information processing devices connected via a network. One of the two information processing devices is a security event monitoring system 1, and the other is a security incident automatic response system 2. Both information processing devices are realized by general-purpose computers equipped with a processor and memory, and function as the security event monitoring system 1 or the security incident automatic response system 2 by using the processor to execute programs stored in the memory.

[0043] The security event monitoring system 1 is a system for detecting cyberattacks, and primarily acquires information such as communication logs from devices such as IoT equipment, and constantly monitors the information to determine whether it contains any undesirable information from a security standpoint that may suggest a cyberattack (so-called security incidents). Specifically, the security event monitoring system 1 includes an incident detection device 10. The incident detection device 10 analyzes the acquired information, and if a security incident is found, outputs information related to the security incident.

[0044] The security incident automatic response system 2 is a system that acquires information about a security incident output by the incident detection device 10, automatically selects, i.e., determines, an appropriate response action (security action) for the security incident, and automatically executes the determined response action. The security incident automatic response system 2 includes a security response action determination device 20 that determines a response action from the information about the security incident, and a security response action execution device 30 that executes the determined response action.

[0045] The security response action determination device 20 will now be described in more detail with reference to Fig. 2. Fig. 2 is a diagram showing the configuration of the security response action determination device 20 according to an embodiment. As shown in Fig. 2, the security response action determination device 20 includes an incident acquisition unit 21, a storage unit 22, a security action list determination unit 23, an action candidate extraction unit 24, an action determination unit 25, and an execution action output unit 26.

[0046] The incident acquisition unit 21 is an example of an acquisition unit and is a processing unit that acquires information about security incidents. The information about security incidents is acquired each time a security incident occurs or every time a predetermined period elapses, for security incidents that occurred within that period.

[0047] Here, information about security incidents will be explained using FIG. 3. FIG. 3 is a diagram for explaining information about security incidents according to an embodiment. FIG. 3 shows three security incidents, No. I-1, I-2, and I-3, and information about each security incident. As shown in FIG. 3, the information about security incidents includes the type of monitored system in which the security incident occurred and some information about the details of the security incident. The information about security incidents acquired by the incident acquisition unit 21 is used to determine the security action list to read from the storage unit 22 and to extract candidate response actions from the security action list.

[0048] The storage unit 22 is a storage device that stores a security action list including multiple pairs of security actions and execution conditions for executing the security actions, and is configured using semiconductor memory, magnetic memory, etc. The storage unit 22 stores prepared response actions as a security action list. A security action list is prepared for each type of system to be monitored.

[0049] A security action list corresponding to the acquired information about the security incident, i.e., corresponding to the type of monitored system in which the security incident has occurred, is read from the storage unit 22. The timing for reading the security action list from the storage unit 22 may be each time information about a security incident is acquired, or may be each time a predetermined period of time has elapsed. Then, a security action list corresponding to the acquired information about the security incident when the predetermined period of time has elapsed may be read.

[0050] 4 to 8 are diagrams illustrating a plurality of security action lists according to an embodiment. As shown in FIG. 4, the storage unit 22 stores a plurality of types of security action lists corresponding to the types of monitored systems, as described above. Here, security action lists corresponding to three types of monitored systems, No. AL-1, AL-2, and AL-3, and a general-purpose security action list, No. AL-0, for security incidents that do not belong to any of the types of monitored systems are stored.

[0051] As shown in Figure 5, for example, the security action list for No. AL-1, in which the type of monitored system is IT, further includes multiple response actions. Each response action has one or more execution conditions set, and when the acquired information about the security incident is compared with these conditions, the security action to be executed is determined from among the response actions that satisfy the execution conditions. However, there may be multiple response actions that satisfy the execution conditions. In such cases, the response actions that satisfy the execution conditions are first extracted as candidate response actions for execution, and then the response action to be executed is determined from the extracted response actions.

[0052] As shown in Figures 6 and 7, security action lists containing multiple response actions are similarly prepared for the case where the type of monitored system in No. AL-2 is an automobile, and for the case where the type of monitored system in No. AL-3 is a factory. Furthermore, as shown in Figure 8, a security action list is also prepared that contains response actions for information about security incidents that do not belong to any of the types (i.e., for which no dedicated security action list is prepared for each type).

[0053] The security action list determination unit 23 is a processing unit that determines the security action list to be read from the storage unit 22 based on the acquired information about the security incident. The response action that is ultimately executed changes depending on the determined security action list, so the security action list determination unit 23 is part of the function of the determination unit that determines the response action to be executed. For example, the security action list determination unit 23 references the type of monitored system indicated in the acquired information about the security incident and determines a corresponding security action list from multiple security action lists stored in the storage unit 22. Based on this determination, an appropriate security action list is read from the storage unit 22.

[0054] The action candidate extraction unit 24 is a processing unit that extracts candidate response actions to be executed from among the multiple response actions included in the read security action list. The response action to be actually executed is determined from the extracted response actions, so the action candidate extraction unit 24 is part of the function of the determination unit that determines the response action to be executed. As described above, the action candidate extraction unit 24 extracts, as candidates, response actions in the read security action list that satisfy the execution conditions of the acquired information about the security incident.

[0055] The action determination unit 25 is a processing unit that determines a response action to be executed from the extracted candidate response actions based on at least one of (i) whether each of the response actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the response actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the response actions. The action determination unit 25 is part of the function of the determination unit that determines the response action to be executed. The function of the action determination unit 25 will be described in more detail below together with the explanation of the operation.

[0056] The execution action output unit 26 is a processing unit that outputs the response action that has been determined to be executed. The response action output by the execution action output unit 26 is executed by the security response action execution device 30, whereby an appropriate response is automatically implemented in response to the security incident that has occurred.

[0057] The security response action execution device 30 is a processing device that actually executes the response action determined by the security response action determination device 20. Response actions include, for example, issuing a notification, blocking communication, acquiring information, and attempting to restore a state in which a security incident does not occur. Therefore, the security response action execution device 30 is configured to be able to send and receive information to devices such as IoT devices in which a security incident has occurred, relay devices such as gateways when the devices connect to a network, power supply devices that supply power to the devices, and information terminals owned by administrators of the devices.

[0058] [Processing Procedure] Next, an example of the operation of the security response system will be described with reference to Fig. 9 and subsequent figures. Fig. 9 is a sequence diagram for explaining an example of the operation of the security response system according to the embodiment. Figs. 10 to 15 are flowcharts for explaining an example of the operation of the security response action decision device 20 according to the embodiment. Fig. 16 is a diagram for explaining determination based on the possibility of simultaneous execution according to the embodiment. Figs. 17 and 18 are diagrams for explaining determination based on the range of execution conditions according to the embodiment.

[0059] Once installed, the security response system of this embodiment basically operates continuously. By repeatedly executing the process described below, the system monitors for the occurrence of security incidents during continuous operation, and when a security incident is detected, it automatically determines and executes appropriate response actions for the security incident.

[0060] As shown in FIG. 9, in the operation of the security response system, the incident detection device 10 detects the occurrence of a security incident and transmits information about the security incident to the security response action decision device 20 .

[0061] The security response action determination device 20 performs processes from acquiring information about a security incident to determining a response action to be executed. Specifically, the security response action determination device 20 acquires information about the security incident, determines a security action list based on the information about the security incident, reads the determined security action list from the storage unit 22, and determines and extracts candidate response actions corresponding to the information about the security incident from the response actions included in the security action list.

[0062] Furthermore, the security response action determination device 20 determines a response action to be executed from among the candidate response actions, and then transmits the determined response action to the security response action execution device 30.

[0063] The security response action execution device 30 acquires the response action that has been decided to be executed and executes it. For example, the security response action execution device 30 controls various devices so that processing in accordance with the response action is performed by transmitting and receiving necessary information to and from various devices.

[0064] The following description focuses on the operation of the security response action determination device 20. As shown in Fig. 10, first, the incident acquisition unit 21 acquires information about a security incident (S11). Next, the security action list determination unit 23 executes a subroutine to determine a security action list based on the acquired information about the security incident (S12).

[0065] Specifically, as shown in FIG. 11 , the security action list determination unit 23 determines a security action list dedicated to the type of monitored system indicated in the acquired information on the security incident. For example, the security action list determination unit 23 determines whether the type of monitored system indicated in the acquired information on the security incident matches the type of monitored system of the first type in the security action list stored in the storage unit 22. The first type is IT. That is, the security action list determination unit 23 determines whether the monitored system is an IT system (S21). If the monitored system is an IT system (Yes in S21), the security action list determination unit 23 determines to use the IT security action list (S25).

[0066] If the system to be monitored is not related to an IT system (No in S21), the security action list determination unit 23 further determines whether the type of system to be monitored indicated in the acquired information about the security incident matches a second type of system to be monitored that is different from the first type in the security action list stored in the memory unit 22. The second type is an automobile. In other words, it determines whether the system to be monitored is related to an automobile system (S22). If the system to be monitored is related to an automobile system (Yes in S22), the security action list determination unit 23 determines to use the security action list for automobiles (S26).

[0067] If the system to be monitored is not related to an automobile system (No in S22), the security action list determination unit 23 further determines whether the type of system to be monitored indicated in the acquired information about the security incident matches a third type of system to be monitored that is different from the first and second types in the security action list stored in the memory unit 22. The third type is a factory. In other words, it determines whether the system to be monitored is related to a factory system (S23). If the system to be monitored is related to a factory system (Yes in S23), the security action list determination unit 23 determines to use the security action list for factories (S27).

[0068] If the system to be monitored is not related to a factory system (No in S23), the security action list determination unit 23 further determines whether the type of system to be monitored indicated in the acquired information regarding the security incident matches the type of system to be monitored of the fourth type or later in the security action list stored in the memory unit 22 (not shown below).

[0069] Here, after determining whether the type of monitored system indicated in the acquired information regarding the security incident matches the types of monitored systems of all of the security action lists stored in the memory unit 22, if the type of monitored system does not match the type of monitored system of any of the security action lists stored in the memory unit, the security action list determination unit 23 decides to use a general-purpose security action list (S24).

[0070] 10, after the security action list determination unit 23 determines the security action list, the action candidate extraction unit 24 reads the determined security action list from the storage unit 22, and further extracts candidate response actions to be executed from one or more response actions included in the security action list (S13). The extraction of candidate response actions is performed based on whether or not the detailed information about the security incident included in the acquired information about the security incident satisfies the execution conditions set for each of the response actions; here, all response actions that satisfy the execution conditions are extracted as candidates.

[0071] Here, the action determination unit 25 determines whether one response action has been extracted (S14). When one response action has been extracted, the action to be executed from among the extracted response actions is determined. Naturally, this single extracted response action is sufficient, and the process differs from the case where multiple response actions have been extracted. When one response action has been extracted (Yes in S14), the action determination unit 25 determines the extracted candidate response action as the response action to be executed (S15).

[0072] On the other hand, if a plurality of response actions are extracted (No in S14), the action determination unit 25 further determines whether the extracted candidate response actions include the same response action (S17). The same response action may be included in the extracted candidate response actions, for example, when duplicate response actions are included when multiple administrators prepare response actions, when slightly different execution conditions are set for the same response action, or when response actions that perform substantially the same processing, such as a combination of turning off the power to a device and stopping the power supply to the device, are set even with the same execution conditions.

[0073] If the same response action is included (Yes in S17), the action determination unit 25 treats them as a single candidate and performs subsequent processing (S18). On the other hand, if the same response action is not included (No in S17), step S18 is skipped. Thereafter, the action determination unit 25 executes a subroutine to determine the response action to actually be executed from the candidate response actions (S19).

[0074] The subroutine of step S19 is performed according to the flowchart shown in Fig. 12. As shown in Fig. 12, the action determination unit 25 first executes a subroutine for determining a response action based on the possibility of simultaneous execution (S31). In the subroutine for determining a response action based on the possibility of simultaneous execution, it is determined whether or not there is a combination of candidate response actions that can be simultaneously executed (S41), as shown in Fig. 13. For example, as shown in Fig. 16, for combinations of two response actions, at least one of combinations that can be simultaneously executed and combinations that cannot be simultaneously executed is set in advance, and whether or not there is a combination that cannot be simultaneously executed is determined depending on which of the two combinations the action falls under (or does not fall under).

[0075] If there is a combination that can be executed simultaneously (Yes in S41), the corresponding action of the combination that can be executed simultaneously is determined as the corresponding action to be executed from the viewpoint of the possibility of simultaneous execution (S42). On the other hand, if there is no combination that can be executed simultaneously (No in S41), it is determined that there is no corresponding action to be executed from the viewpoint of the possibility of simultaneous execution (S43). The corresponding action to be executed here that has been determined from the viewpoint of the possibility of simultaneous execution may be ultimately determined as a corresponding action not to be executed from the viewpoint of the number of conditions of the execution conditions and the range of the conditions, which will be described later.

[0076] Note that when response actions are determined as response actions to be executed from the viewpoint of simultaneous execution possibility, if one of the response actions is executed, the other is also executed. However, this "simultaneous" in the sense of being executed simultaneously in response to the security incident, so they may be executed one after the other in chronological order. Therefore, in chronological order, it may be determined that simultaneous execution is possible only in a specific order, and that simultaneous execution is not possible in other orders. Information regarding such an order may also be set after verification or the like in advance, and added to and managed in a list such as that shown in FIG. 16.

[0077] After executing the subroutine for determining the corresponding action based on the possibility of simultaneous execution, it is determined whether or not the corresponding action to be executed can be determined based on this viewpoint alone (for example, when two corresponding actions are extracted and both can be executed simultaneously) (S32). If the corresponding action to be executed can be determined based on this viewpoint alone (Yes in S32), that corresponding action is determined as the corresponding action to be executed, and the process ends. If the corresponding action to be executed cannot be determined based on the viewpoints up to this point (No in S32), proceed to the next step.

[0078] Next, the action determination unit 25 executes a subroutine for determining a response action based on the number of conditions of the execution conditions (S33). In the subroutine for determining a response action based on the number of conditions of the execution conditions, as shown in Fig. 14, it is determined whether or not there is one response action among the candidate response actions with the largest number of conditions of the execution conditions (S51).

[0079] If there is one response action with the most conditions for execution (Yes in S51), the response action with the most conditions for execution is determined as the response action to be executed in terms of the number of conditions for execution (S52). On the other hand, if there is not one response action with the most conditions for execution (No in S51), it is determined that there is no response action to be executed in terms of the number of conditions for execution (S53). The response action to be executed here determined in terms of the number of conditions for execution may ultimately be determined not to be executed in terms of the range of conditions, which will be described later.

[0080] After executing the subroutine that determines the response action based on the number of conditions of the execution condition, it is determined whether or not the response action to be executed can be determined based on the viewpoints up to this point (S34). If the response action to be executed can be determined based on the viewpoints up to this point (Yes in S34), the response action is determined as the response action to be executed, and the process ends. If the response action to be executed cannot be determined based on the viewpoints up to this point (No in S34), the process proceeds to the next step.

[0081] Next, the action determination unit 25 executes a subroutine for determining a response action based on the range of conditions for the execution conditions (S35). In the subroutine for determining a response action based on the range of conditions for the execution conditions, as shown in FIG. 15 , for all candidate response actions, a candidate response action corresponding to the condition with the narrowest numerical range for satisfying the execution condition is selected (S61). Furthermore, among the options provided for the execution condition, a candidate response action corresponding to the condition with the fewest options for satisfying the execution condition is selected (S62). The selection process in steps S61 and S62 selects more response actions corresponding to the narrower range of conditions for execution based on the two axes of numerical range and options. In other words, a response action that is selected more frequently has more severe execution conditions and is more specific to a security incident than a response action that is selected less frequently.

[0082] For example, Figure 17 shows the range of execution conditions for No. A-1-3, and Figure 18 shows the range of execution conditions for A-1-4 superimposed on the range of execution conditions for No. A-1-3. If the elapsed time since infection is within the range of 24 to 48 hours and the business impact of shutting down the infected terminal is large, both the execution conditions for No. A-1-3 and No. A-1-4 are met. However, compared to the response action A-1-3, the response action A-1-4 can be applied to cases where the elapsed time is within the range of 0 to 24 hours and where the business impact of shutting down the infected terminal is medium, so it can be said to be a more general response action. Conversely, the response action A-1-3 is a more specific response action than the response action A-1-4, and is therefore likely to be a more appropriate response action.

[0083] In addition, when an execution condition is provided that corresponds to an axis other than the two axes of the numerical range and the option, a step may be inserted so that the execution condition with the narrower condition range is selected.

[0084] Then, it is determined whether or not there is one candidate response action that has been selected the most times in total in the above steps (S63).

[0085] If there is one response action that has been selected the most times in total (Yes in S63), the response action that has been selected the most times in total is determined to be the response action that should be executed in terms of the range of the conditions of the execution conditions (S64).On the other hand, if there is not one response action that has been selected the most times in total (No in S63), it is determined that there is no response action that should be executed in terms of the range of the conditions of the execution conditions (S65).

[0086] After executing the subroutine that determines the response action based on the range of the execution conditions, it is determined whether or not the response action to be executed can be determined based on the perspectives up to this point (S36). If the response action to be executed based on the perspectives up to this point can be determined (Yes in S36), that response action is determined as the response action to be executed, and the process ends. If the response action to be executed based on the perspectives up to this point cannot be determined (No in S36), it is determined that there is no response action that can be executed (S37).

[0087] It should be noted that the order in which the subroutines are executed in the flowchart of Fig. 12 is not limited to that shown in Fig. 12. For example, step S33 and step S34 may be inserted after step S36. However, it is preferable that step S31 be executed before steps S33 and S35. This makes it possible to determine whether or not to execute a combination of response actions that can be executed simultaneously from yet another perspective, which has the advantage of making it easier to determine a more appropriate response action.

[0088] Returning to FIG. 10, after step S15 or step S19, the determined response action is outputted to be executed by the security response action execution device 30 (S16).

[0089] (Other Embodiments) Although the security response action determination method and the like according to the present disclosure have been described above based on the embodiments, the present disclosure is not limited to the above-described embodiments and modifications.

[0090] For example, the present disclosure may be embodied as the above-described methods. Furthermore, the present disclosure may be embodied as a computer program for implementing these methods on a computer, or as a digital signal comprising a computer program. For example, one aspect of the present disclosure may be a computer program for causing a computer to execute each of the characteristic steps included in the log priority calculation method.

[0091] The present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. Alternatively, the present disclosure may be a digital signal recorded on such a recording medium.

[0092] The present disclosure may also be applied to transmitting a computer program or a digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like.

[0093] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and other orders may be used. Some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0094] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0095] Furthermore, the above-described embodiments and modifications may be combined with each other. Furthermore, various modifications that a person skilled in the art may conceive of may be made to the present embodiment, and configurations constructed by combining components of different embodiments may also be included in the present disclosure, as long as they do not deviate from the spirit of the present disclosure.

[0096] The present disclosure is useful for an apparatus for determining an abnormality.

[0097] REFERENCE SIGNS LIST 1 Security event monitoring system 2 Security incident automatic response system 10 Incident detection device 20 Security response action determination device 21 Incident acquisition unit 22 Storage unit 23 Security action list determination unit 24 Action candidate extraction unit 25 Action determination unit 26 Execution action output unit 30 Security response action execution device

Claims

1. A security response action determination method using a computer for determining a security action in response to the occurrence of a security incident, the method comprising the steps of: reading out a security action list stored in a memory unit, the security action list including a plurality of pairs of security actions and execution conditions for executing the security actions; acquiring information related to the security incident that has occurred; determining a security action to be executed from among the security actions in the security action list for which information related to the security incident that has occurred satisfies the execution conditions, the security action to be executed being determined based on at least one of (i) whether each of the security actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the security actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the security actions; and outputting the determined security action.

2. The security response action determination method described in claim 1, wherein the memory unit stores a plurality of security action lists corresponding to each system to be monitored, and in the reading step, the security action list corresponding to the system in which the security incident occurred is read out of the plurality of security action lists based on information regarding the security incident that occurred.

3. The security response action determination method according to claim 1 or 2, wherein in the determining step, candidate security actions are extracted from the security action list, which are security actions for which information about the security incident that has occurred satisfies the execution conditions, and the security action to be executed is determined from the extracted candidate security actions based on at least one of (i), (ii), and (iii).

4. The security response action determination method according to claim 3, wherein in the determination step, two or more security action candidates corresponding to the same security action among the extracted security action candidates are treated as one security action candidate.

5. A security response action determination method as described in claim 3 or 4, wherein in the determining step, the security action to be executed is determined from among two or more security action candidates that correspond to non-identical security actions among the extracted security action candidates, based on at least one of (i), (ii), and (iii).

6. A security response action determination method according to any one of claims 1 to 6, wherein in the determining step, if one of the security actions that can be executed simultaneously is determined as the security action to be executed based on (i) from among the security actions that satisfy the execution conditions, the other is also determined as the security action to be executed.

7. A security response action determination method according to any one of claims 1 to 6, wherein in the determining step, the security action to be executed is determined to be the security action that contains the largest number of conditions in the execution conditions corresponding to each of the security actions based on (ii) from among the security actions that satisfy the execution conditions.

8. A security response action determination method according to any one of claims 1 to 7, wherein in the determining step, the security action that executes is determined to be the security action that includes the narrowest range of conditions included in the execution conditions corresponding to each of the security actions based on (iii) from among the security actions that satisfy the execution conditions.

9. A security response action determination method according to any one of claims 1 to 8, wherein in the determining step, a determination based on (i) is made, and then a determination based on at least one of (ii) and (iii) is made.

10. The security response action determination method of claim 9, wherein in the determining step, from among the security actions that satisfy the execution conditions, among the security actions that are determined not to be executable simultaneously in the determination based on (i), a security action that satisfies at least one of the following is executed: the security action that is determined to have the largest number of conditions included in the corresponding execution conditions in the determination based on (ii) and the security action that is determined to have the narrowest range of conditions included in the corresponding execution conditions in the determination based on (iii).

11. A security response action determination device that determines a security action in response to a security incident when the security incident occurs, comprising: a memory unit that stores a security action list including multiple pairs of security actions and execution conditions for executing the security action; an acquisition unit that acquires information related to the security incident that has occurred; a step of determining the security action to be executed from among the security actions in the security action list for which the information related to the security incident that has occurred satisfies the execution conditions, the determination unit determining the security action to be executed based on at least one of (i) whether each of the security actions can be executed simultaneously, (ii) the number of conditions included in the execution conditions corresponding to each of the security actions, and (iii) the range of conditions included in the execution conditions corresponding to each of the security actions; and an output unit that outputs the determined security action.

12. A program for causing a computer to execute the security response action decision method according to any one of claims 1 to 10.

Images