Attack method analysis assistance device

Abstract

The present invention reduces the man-hours required to analyze cyber attack methods. This attack method analysis assistance device comprises a processor and a memory, and is characterized in that: the memory stores protected assets and attack methods of cyber attacks on the protected assets in association with each other, the protected assets being any of functions of system elements that constitute an information processing system, data that are processed by the functions of system elements, functions of software that constitute the system elements, or data that are processed by the software functions; and the processor identifies, on the basis of information received from a user via an input device, a protected asset subject to analysis, finds similarities between the protected asset subject to analysis and the protected assets stored in the memory, identifies, on the basis of the similarities, an attack method on the protected asset subject to analysis from the attack methods associated with the protected assets stored in the memory, and causes an output device to output the identified attack method on the protected asset subject to analysis.

Description

Attack Method Analysis Support Device

[0001] The present invention relates to an attack method analysis support device.

[0002] Cyberattacks on protected assets, including functions of information processing systems and data processed by those functions, have become a problem. For example, Patent Literature 1 discloses a program for analyzing cyberattacks, including the location of the cyberattack, the perpetrator of the cyberattack, the timing of the cyberattack, the reason for the cyberattack, and the target of the cyberattack.

[0003] Japanese Patent Application Laid-Open No. 2022-101716

[0004] However, in recent years, the number of protected assets included in information processing systems has increased, and analyzing the attack methods of cyber attacks has required a great deal of man-hours.

[0005] The present invention has been made in consideration of the above points, and aims to provide an attack method analysis support device that can reduce the amount of work required to analyze attack methods of cyber attacks.

[0006] The attack method analysis support device of the present invention is an attack method analysis support device comprising a processor and a memory, wherein the memory stores protected assets, which are either functions of system elements constituting an information processing system, data processed by the functions of the system elements, or functions of software constituting the system elements and data processed by the functions of the software, in association with attack methods of cyber attacks against the protected assets, and the processor identifies the protected asset to be analyzed based on information received from a user via an input device, calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory, identifies an attack method against the protected asset to be analyzed from the attack methods associated with the protected assets stored in the memory based on the similarity, and outputs the identified attack method against the protected asset to be analyzed to an output device.

[0007] According to the present invention, the man-hours required for analyzing cyber-attack methods can be reduced. Further features related to the present invention will become apparent from the description of this specification and the accompanying drawings. In addition, the problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

[0008] 10 。 A block diagram showing an attack method analysis support device according to an embodiment. A diagram showing system elements. A diagram showing protected assets of software constituting the system element of FIG. 2A. A table showing correspondence relationships related to functions in FIG. 2B. A table showing correspondence relationships related to data in FIG. 2B. A table showing protected assets shown in FIGS. 2A and 2B. A table showing the correspondence between protected assets of the system elements shown in FIGS. 2A and 2B and attack methods. A diagram showing a method of applying attack methods against protected assets of the system element of FIG. 5 to attack methods against protected assets of software. A table showing the correspondence between protected assets of the system elements and software included in FIG. 5 and attack methods. A flowchart showing a method of calculating similarity based on topic analysis of design documents. A diagram showing a method of selecting protected assets belonging to lower categories from higher categories. A diagram showing classification of protected assets by nodes in a tree structure. A diagram showing a method of calculating similarity between protected assets using the tree structure of FIG. 10. A flowchart showing an overview of the operation of an attack method analysis support device according to an embodiment. A flowchart showing the operation of calculating similarity from the correspondence relationships between protected assets of system elements and protected assets of software constituting the system elements to identify attack methods. A flowchart showing the operation of calculating similarity from the correspondence relationships between protected assets of system elements and protected assets of software constituting the system elements. 1 is a flowchart showing an operation of identifying an attack method by calculating a similarity from the distance between nodes in a tree structure. FIG. 1 is a flowchart showing an operation of identifying an attack method using a first similarity, a second similarity, and a third similarity, and outputting the identified attack method. FIG. 2 is a sequence diagram showing an operation of analyzing an attack method for a system element from the correspondence between the protected asset of a concept and the protected asset of a system element in an attack method analysis support device according to an embodiment. FIG. 3 is a sequence diagram showing an operation of analyzing an attack method for software from the correspondence between the protected asset of a system element and the protected asset of software in an attack method analysis support device according to an embodiment. FIG. 4 is a sequence diagram showing an operation of analyzing an attack method for a protected asset to be analyzed that has different system elements in an attack method analysis support device according to an embodiment. FIG. 5 is a table showing the similarity between the protected asset to be analyzed and the protected asset for which the attack method has been analyzed, for each analysis method. A table showing the protected asset to be analyzed and the attack methods for the protected asset to be analyzed, for each analysis method, displayed in order of priority. A table showing an example of a display of the analysis results of an attack method. FIG. 6 is a diagram showing the concept of analysis of an attack method for a protected asset according to an embodiment.10A and 10B are diagrams illustrating the concept of analyzing a method of attacking a protected asset according to an embodiment, and the concept of determining whether or not an attack has occurred on a protected asset according to an embodiment.

[0009] Hereinafter, an attack method analysis support device according to the present invention will be described with reference to the drawings.

[0010] 1 is a device for supporting the analysis of cyber-attack methods against protected assets included in an information processing system. The attack method analysis support device 600 provides guidelines on cyber-attack methods to users, such as designers of the information processing system and designers of security systems for the information processing system.

[0011] A protected asset means, for example, the function of the concept that is the highest-level concept of an information processing system, the data processed by the function of the concept, the function of a system element that constitutes an information processing system to realize the concept, the data processed by the function of the system element, the function of software that constitutes a system element, and the data processed by the function of the software.A protected asset of a concept is either the function of a concept or the data processed by the function of the concept.A protected asset of a system element is either the function of a system element or the data processed by the function of the system element.A protected asset of software is either the function of the software or the data processed by the function of the software.

[0012] A cyberattack on a protected asset means, for example, an act of impeding the function of the protected asset, an act of tampering with the function of the protected asset, an act of stealing data from the protected asset, or an act of tampering with data from the protected asset. The attack method of a cyberattack includes, for example, the location of the cyberattack, the perpetrator of the cyberattack, the timing of the cyberattack, the reason for the cyberattack, and information about the protected asset that is the target of the cyberattack.

[0013] The attack method analysis support device 600 includes a processor 100, a memory 200, an input device 300, and an output device 400. The processor 100, the memory 200, the input device 300, and the output device 400 are connected via a network 500. The processor 100 is a computer including a CPU (Central Processing Unit), a ROM (Read Only Memory), and a RAM (Random Access Memory). The processor 100 performs the processing described below by the CPU of the processor 100 executing computer programs stored in the ROM and RAM of the processor 100.

[0014] The memory 200 is an auxiliary storage device such as a hard disk drive (HDD) or a solid state drive (SDD). The processor 100 and the memory 200 are a server connected to a network 500. Note that the term "server" refers to a processing device that can send and receive information to and from a communication device via a communication line or the like, and does not refer to hardware such as a personal computer or an embedded information device.

[0015] The input device 300 is, for example, a keyboard and a mouse of an information processing terminal such as a personal computer operated by a user such as the designer of the information processing system and the designer of a security system for the information processing system. The input device 300 receives an input specifying a protected asset for which an attack method is to be analyzed.

[0016] The output device 400 is, for example, a display of an information processing terminal such as a personal computer operated by a user such as the designer of the information processing system and the designer of a security system for the information processing system. The output device 400 outputs the similarity between the protected asset to be analyzed and the protected asset associated with the attack method of the cyber-attack stored in the memory 200, the attack method against the identified protected asset to be analyzed, and the process of analyzing the attack method.

[0017] The processor 100 includes a control unit 110, a memory 120, a communication unit 130, an analysis target identification unit 140, a protected asset similarity calculation unit 150, and an attack method identification unit 160. The control unit 110 controls the operation of the memory 120, the communication unit 130, the analysis target identification unit 140, the protected asset similarity calculation unit 150, and the attack method identification unit 160 of the processor 100. The control unit 110 causes the output device 400 to output the attack method against the protected asset to be analyzed, which has been identified by the attack method identification unit 160.

[0018] The memory 120 stores a plurality of protected assets and attack methods against the protected assets in association with each other. For example, in order to analyze attack methods against the protected assets, the memory 120 temporarily stores the protected assets and attack methods against the protected assets that are stored in the memory 200 and received via the network 500 and the communication unit 130. The communication unit 130 communicates with the processor 100, the memory 200, the input device 300, and the output device 400 via the network 500.

[0019] The analysis target identification unit 140 identifies a protected asset to be analyzed based on information received from a user via the input device 300. The protected asset similarity calculation unit 150 calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory 200. The attack method identification unit 160 identifies an attack method against the protected asset to be analyzed from the attack methods associated with the protected assets stored in the memory 200 based on the similarity.

[0020] The memory 200 stores protected asset information 210 and attack method analysis results 220. The protected asset information 210 includes correspondence relationships 211, design documents 212, and hierarchical classifications 213.

[0021] The correspondence 211 includes information on a plurality of protected assets of a concept. The correspondence 211 includes information on a plurality of protected assets of a system element. The correspondence 211 includes information on a plurality of protected assets of software. The correspondence 211 includes information on the correspondence between the protected assets of the concept that is the highest concept of an information processing system, the protected assets of the system elements that constitute the information processing system to realize the concept, and the protected assets of the software that constitutes the system elements.

[0022] 2A, for example, the protected assets of a system element include a function α, a function β, and data γ of the system element, where the data processed by the function α with respect to the input is the data γ.

[0023] 2B, the protected assets of the software that constitute function α, which is the protected asset of the system element, include function A, function B, function C, function D, data γ'1, data γ'2, data γ'3, and data γ'4. Data γ'1 is data that is input to function α, processed by function A, and output to function B. Data γ'2 is data that is input to function A, processed by function B, and output to function C.

[0024] Data γ'3 is the data input to function α, processed by function A, and output to function D. Data γ'4 is the data input by function A, processed by function D, and output to function C. Data γ'2 is the data input by function B, and data γ'4 is the data input by function D, processed by function C, and output as the output of function α.

[0025] In this embodiment, function α, which is a protected asset of a system element as shown in Figure 2B, corresponds to functions A, B, C, and D, which are protected assets of software that constitute the system element, and are considered to be protected assets of the same type. Furthermore, among the multiple protected assets stored in memory 200, the similarity between a system element that corresponds to the protected asset to be analyzed and a system element that corresponds to the protected asset stored in memory 200 is considered to be the first similarity.

[0026] A protected asset with a first similarity is a protected asset with the highest similarity. In the example of Figure 2B, functions A, B, C, D, and α are protected assets with a first similarity because they all share function α of the protected assets of the system elements. Data γ'1, data γ'2, data γ'3, data γ'4, and data γ are protected assets with a first similarity because they all share data γ of the protected assets of the system elements.

[0027] 3A is a table showing the correspondence 211 related to the functions in FIG. 2B. A parent node (function) ID, a function name, and a design document are associated with each node (function) ID. A node (function) ID is the ID of a protected asset of software that constitutes a system element. A parent node (function) ID is the ID of a protected asset of a system element. As shown in FIG. 3A, the correspondence 211 stored in the memory 200 includes a correspondence between function α of the protected asset of the system element and functions A, B, C, and D of the protected asset of the software. In other words, the memory 200 stores function α of the protected asset of the system element in association with functions A, B, C, and D of the protected asset of the software.

[0028] 3B is a table showing a correspondence 211 related to the data in FIG. 2B. A parent data ID, an output node ID, an input node ID, a data name, and a design document are associated with a data ID. A data ID is an ID of data output from a function of a protection asset of software. A parent data ID is an ID of data output from a function of a protection asset of a system element. As shown in FIG. 3B, the correspondence 211 stored in the memory 200 includes a correspondence between data γ of a protection asset of a system element and data γ'1, γ'2, γ'3, and γ'4 of protection assets of software. In other words, the memory 200 stores data γ of a protection asset of a system element in association with data γ'1, γ'2, γ'3, and γ'4 of protection assets of software.

[0029] 3A and 3B, correspondences between function protection assets and between data protection assets are stored, but correspondences between function protection assets and data protection assets may also be stored. Correspondences also hold between concept protection assets, between system element protection assets, and between software protection assets. In this case, it means the same concept, the same system element, and the same software. The design documents in FIGS. 3A and 3B are various text data created to design the protection assets.

[0030] 4 is a table showing the protected assets shown in FIGS. 2A and 2B. In this embodiment, as shown in FIG. 4, the protected assets shown in FIGS. 2A and 2B are stored in the memory 200. When attack methods against the protected assets have already been analyzed, attack method analysis result IDs and design documents may be associated with protected asset IDs and stored in the memory 200 as shown in FIG. 5. As shown in FIG. 5, for example, with respect to functions α and β and data γ, which are protected assets of a system element, already analyzed attack methods are stored in the correspondence 211 of the memory 200. On the other hand, with respect to the protected assets of the software that constitute the system elements, attack methods have not yet been analyzed.

[0031] 6 is a diagram showing a method of applying an attack method on a protected asset of a system element to an attack method on a protected asset of software. As shown in FIG. 6, in this embodiment, the protected asset similarity calculation unit 150 determines that the protected asset of software constituting a system element has a high similarity to the protected asset of the system element. The protected asset similarity calculation unit 150 of the processor 100 determines, as the highest first similarity, the similarity of a protected asset that is shared between a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200, among the multiple protected assets stored in the memory 200.

[0032] The attack method identification unit 160 of the processor 100 identifies, among the multiple protection assets stored in the memory 200, an attack method associated with a protection asset with a first similarity as an attack method against the protection asset to be analyzed. In the example of Fig. 6, for function α, which is a protection asset of a system element, an attack method that has already been analyzed by, for example, guide word analysis, is identified as an attack method against functions A, B, C, and D, which are protection assets of software that constitute the system element. Similarly, for data γ, which is a protection asset of a system element, an attack method that has already been analyzed by, for example, guide word analysis, is identified as an attack method against data γ'1, which is a protection asset of software that constitutes the system element.

[0033] Fig. 7 is a table showing the correspondence between the protected assets of system elements and software and the attack methods. In Fig. 7, the protected asset ID is associated with the attack method analysis result ID indicating the attack method identified by the attack method identification unit 160 and the design document. As shown in Fig. 7, the attack methods against the protected assets of software identified as described above are stored in the correspondence relationship 211 of the memory 200. The attack methods against the protected assets of the system elements are identified as the attack methods against the protected assets of the software that constitute the system elements.

[0034] In the above example, an attack method against the protected asset of a system element is identified as an attack method against the protected asset of software that constitutes a system element, but similarly, an attack method against the protected asset of a concept may be identified as an attack method against the protected asset of a system element that realizes a concept. Furthermore, as an attack method against the protected asset of software that constitutes a system element, an attack method that has already been identified for the protected asset of software that constitutes the same system element may be identified. Furthermore, as an attack method against the protected asset of a system element that realizes a concept, an attack method that has already been identified for the protected asset of a system element that realizes the same concept may be identified.

[0035] 8 is a flowchart showing a method for calculating similarity based on topic analysis of design documents. As described above, the design documents 212 of the protected asset information 210 in the memory 200 shown in FIG. 1 are various text data created for designing protected assets. In this embodiment, the memory 200 stores design documents 212 for multiple protected assets. As shown in FIG. 8, in response to input of a design document 212 related to a function A to be newly analyzed (S11), the memory 200 stores a design document 212 related to a function B for which attack methods have been analyzed in the past and a design document 212 related to a function C for which attack methods have been analyzed in the past (S12, S13).

[0036] The protected asset similarity calculation unit 150 determines the similarity by topic analysis of the design document 212 (S14). The protected asset similarity calculation unit 150 determines, as the highest second similarity, the similarity of a protected asset among the multiple protected assets stored in the memory 200, which has the smallest difference between the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory 200 (S15).

[0037] For topic analysis, techniques such as Latent Semantic Indexing (LSI), Probabilistic Latent Semantic Indexing (PLSI), and Latent Dirichlet Allocation (LDA) can be applied. The difference in topic composition ratio can be calculated, for example, by comparing the differences in composition ratios of several topics in descending order of appearance frequency. In the example of FIG. 8 , the similarity between function A and function B is calculated to be 80%, and the similarity between function A and function C is calculated to be 20%. The attack method identification unit 160 of the processor 100 identifies, from among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the second similarity as an attack method against the protected asset to be analyzed.

[0038] 1 includes a hierarchical classification 213. The hierarchical classification 213 includes a classification relationship 214 and configuration information 215. As the classification relationship 214, the memory 200 stores classifications to which each of a plurality of protected assets belongs, hierarchically descending from a superordinate concept to a subordinate concept, as shown in FIG.

[0039] 10 , the memory 200 stores, as classification relationships 214, a tree structure T in which each of a plurality of protected assets belongs to a classification cl based on any one of nodes N in the tree structure T, and the classifications change from a higher-level classification cl to a lower-level classification cl as the hierarchy progresses from a higher-level node N to a lower-level node N connected by a link L. The attributes ab of the protected assets included in the classification cl are included in the configuration information 215.

[0040] The protected asset similarity calculation unit 150 of the processor 100 determines, as the highest third similarity, the similarity of a protected asset that has the shortest distance between the node N of the category cl to which the protected asset to be analyzed belongs and the node N of the category cl to which the protected asset stored in the memory 200 belongs, among the multiple protected assets stored in the memory 200. The tree structure T and the category cl based on the tree structure T can be determined arbitrarily. The distance between one node N and another node N can be, for example, the number of links L between the one node N and the other node N.

[0041] 11 , for example, the number of links L between the node N of the TCU (concrete class) including the TCU instance and the node N of Navi including the Navi instance is 2, so the distance between the node N of the TCU (concrete class) and the node N of Navi can be set to 2. On the other hand, the number of links L between the node N of the TCU (concrete class) including the TCU instance and the node N of the ECU power supply module including the ECU-power supply module instance is 6, so the distance between the node N of the TCU (concrete class) and the node N of the ECU power supply module can be set to 6.

[0042] Because the distance between the node N of the TCU (concrete class) and the node N of Navi is shorter than the distance between the node N of the TCU (concrete class) and the node N of the ECU power supply module, the protected asset similarity calculation unit 150 determines that the protected asset of Navi has a higher similarity to the protected asset of the TCU (concrete class) than the protected asset of the ECU power supply module. In this manner, the protected asset similarity calculation unit 150 of the processor 100 calculates a third similarity. The attack method identification unit 160 of the processor 100 identifies, from among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the third similarity as an attack method against the protected asset being analyzed.

[0043] The attack method analysis result 220 in the memory 200 shown in FIG. 1 includes an attack method 221 and attack method analysis process information 222. The attack method 221 includes an attack method against a protected asset identified as described above. The attack method analysis process information 222 includes the first similarity, second similarity, third similarity, protected asset of first similarity, protected asset of second similarity, and protected asset of third similarity obtained as described above, and the attack method identified by them. The attack method analysis process information 222 also includes information on modification of the attack method in accordance with a user request. In other words, the attack method analysis process information 222 includes information on the process of analyzing the attack method.

[0044] The operation of the attack method analysis support device 600 of this embodiment will be described below. FIG. 12 is a flowchart showing an outline of the operation of the attack method analysis support device according to the embodiment. As shown in FIG. 12, when the input device 300 receives an input of a data flow diagram to be analyzed and a correction due to the input (S101), the control unit 110 of the processor 100 accepts the input and correction from the input device 300 (S102). The control unit 110 displays the data flow diagram to be analyzed on the output device 400 (S103). When the input of a data flow diagram to be analyzed and a correction due to the input are not received (S101), the processor 100 proceeds to S104.

[0045] The analysis target identification unit 140 selects functions or data in the data flow diagram as protected assets for attack method analysis (S104). The protected asset similarity calculation unit 150 calculates the similarity of the protected assets (S105). The attack method identification unit 160 identifies attack methods against the analyzed protected assets as attack methods against the analyzed protected asset, and the control unit 110 displays the analysis results of the attack methods in order of similarity to the analyzed protected asset (S106). The control unit 110 causes the output device 400 to output the attack methods against the analyzed protected asset identified by the attack method identification unit 160.

[0046] The input device 300 accepts an input from the user to select the analysis result of the attack method (S107). The input device 300 accepts an input from the user to modify the analysis result of the attack method (S108). The control unit 110 stores the protected asset and information about the input and modified attack methods against the protected asset in the memory 200 (S109).

[0047] 13 , in calculating the similarity in S105 and identifying the attack method in S106, the protected asset similarity calculation unit 150 determines, as the highest first similarity, the similarity of a protected asset that has a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200 in common (S201). The attack method identification unit 160 identifies, as the attack method against the protected asset to be analyzed, the attack method that is associated with the protected asset with the first similarity among the multiple protected assets stored in the memory 200 (S202).

[0048] 14, for the calculation of similarity in S105 and the identification of attack methods in S106, the protected asset similarity calculation unit 150 calculates the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed (S301). The protected asset similarity calculation unit 150 calculates the topic composition ratio in the topic analysis of the design document 212 related to the protected asset stored in the memory 200 (S302).

[0049] The protected asset similarity calculation unit 150 determines as the highest second similarity the similarity of a protected asset among the multiple protected assets stored in the memory 200, which has the smallest difference between the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document 212 related to the protected asset stored in the memory 200 (S303). The attack method identification unit 160 identifies, among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the second similarity as an attack method against the protected asset to be analyzed (S304).

[0050] 15 , in calculating the similarity in S105 and identifying the attack method in S106, the protected asset similarity calculation unit 150 determines, among the multiple protected assets stored in the memory 200, the similarity of a protected asset that has the shortest distance between the node N of the category cl to which the protected asset to be analyzed belongs and the node N of the category cl to which the protected asset stored in the memory 200 belongs, as the third similarity (S401). The attack method identification unit 160 identifies, among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the third similarity as the attack method against the protected asset to be analyzed (S402).

[0051] The following describes a method for selectively using protected assets with the first, second, and third similarities. FIG. 16 is a flowchart illustrating the operation of identifying attack methods based on the first, second, and third similarities and outputting the identified attack methods. As shown in FIG. 16 , the processor 100 receives information regarding priority from the user via the input device 300 (S501). When a protected asset stored in the memory 200 contains a system element that corresponds to the protected asset to be analyzed and a system element that corresponds to the protected asset stored in the memory 200 (S502), the protected asset similarity calculation unit 150 identifies a protected asset with the first similarity as described above (S503). The attack method identification unit 160 identifies an attack method associated with a protected asset with the first similarity among the protected assets stored in the memory 200 as an attack method against the protected asset to be analyzed (S504).

[0052] The protected asset similarity calculation unit 150 identifies protected assets of the second and third similarities as described above (S505). The attack method identification unit 160 identifies, among the multiple protected assets stored in the memory 200, the attack methods associated with the protected assets of the second and third similarities as attack methods against the protected asset to be analyzed (S506). Note that, when there is a protected asset among the multiple protected assets stored in the memory 200 in which the system element corresponding to the protected asset to be analyzed is common to the system element corresponding to the protected asset stored in the memory 200 (S502), the processes of S505 and S506 may be omitted.

[0053] On the other hand, when there is no protected asset among the plurality of protected assets stored in the memory 200 in which the system element corresponding to the protected asset to be analyzed is in common with the system element corresponding to the protected asset stored in the memory 200 (S502), the protected asset similarity calculation unit 150 identifies protected assets of the second and third similarities as described above (S507). The attack method identification unit 160 identifies, among the plurality of protected assets stored in the memory 200, the attack methods associated with protected assets of the second and third similarities as attack methods against the protected asset to be analyzed (S508).

[0054] The control unit 110 outputs to the output device, in order of priority, an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the first similarity, an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the second similarity, and an attack method against the protected asset to be analyzed identified from the attack methods associated with the protected asset of the third similarity.

[0055] The following describes the cooperative operation of the input device 300, output device 400, processor 100, and memory 200 for the user. An example will be described below with reference to Fig. 17 in which attack methods against the protected assets of a concept are stored in the memory 200 and attack methods against the protected assets of a system element that realizes the concept are identified.

[0056] 17 is a sequence diagram showing the operation of analyzing an attack method on a system element from the correspondence between the protected assets of a concept and the protected assets of a system element in an attack method analysis support device according to an embodiment. As shown in FIG. 17 , the input device 300 accepts input of the protected assets of a concept and the analysis results of the attack methods on the protected assets of the concept from an analyst of an attack method on a new protected asset (S601). The analysis results of the protected assets of the concept and the attack methods on the protected assets of the concept are stored in the memory 200 via the input device 300 and the processor 100 (S602, S603).

[0057] The input device 300 receives an input of a protected asset selection candidate request for a system element from an analyst of attack methods against a new protected asset (S604). The protected asset selection candidate request for a system element is transmitted to the processor 100 via the input device 300 (S605). The processor 100 retrieves the protected asset of the system element from the memory 200 (S606). The processor 100 causes the output device 400 to output a list of the protected asset selection candidates for the system element retrieved from the memory 200 (S607, S608, S609).

[0058] The input device 300 receives an input specifying a protected asset of a system element from an analyst of attack methods against a new protected asset (S610). The specified protected asset of the system element is transmitted to the processor 100 via the input device 300 (S611). The processor 100 retrieves the analysis results of the protected asset of the system element and the attack methods against the protected asset of the system element from the memory 200 (S612). The processor 100 causes the output device 400 to output the analysis results of the protected asset of the system element and the attack methods against the protected asset of the system element retrieved from the memory 200 (S613, S614, S615).

[0059] The input device 300 receives an input of a request to modify the analysis results of the attack methods from an analyst of attack methods against a new protected asset (S616). The request to modify the analysis results of the attack methods is sent to the processor 100 via the input device 300 (S617). The processor 100 retrieves the analysis results of the attack methods against the protected assets of the system elements from the memory 200 (S618). The processor 100 modifies the analysis results of the attack methods against the protected assets of the system elements retrieved from the memory 200, and outputs them to the output device 400 (S619, S620, S621).

[0060] An example will be described below with reference to Fig. 18 in which attack methods against the protected assets of system elements are stored in the memory 200, and attack methods against the protected assets of software that constitute the system elements are identified. Fig. 18 is a sequence diagram showing the operation of an attack method analysis support device according to an embodiment, in which software attack methods are analyzed based on the correspondence between the protected assets of system elements and the protected assets of software. As shown in Fig. 18, the concept of Fig. 17 is replaced with system elements, and the system elements are replaced with software, and the processes of S701 to S721, which are similar to the processes of S601 to S621 in Fig. 17, are performed.

[0061] Below, using Figure 19, we will explain an example of identifying an attack method against a software's protected asset when, among the multiple protected assets stored in memory 200, there is no protected asset that has a system element that corresponds to the protected asset of the software being analyzed and a system element that corresponds to the protected asset stored in memory 200 in common.

[0062] 19 is a sequence diagram showing the operation of analyzing attack methods on protected assets of different system elements in an attack method analysis support device according to an embodiment. As shown in FIG. 19 , the input device 300 receives input of the protected assets of the system elements and the analysis results of the attack methods on the protected assets of the system elements from an analyst of past attack methods on protected assets (S801). The protected assets input by the analyst of past attack methods on protected assets are different in corresponding system elements from the system elements that correspond to the protected assets that will be subsequently analyzed by an analyst of attack methods on new protected assets.

[0063] Thereafter, the processes of S802 to S821 are performed, which are similar to the processes of S702 to S721 in Fig. 18. However, in S812, the attack method against the protected asset called up by the processor 100 from the memory 200 is the attack method against the protected asset with the second similarity and the third similarity, as described above.

[0064] The analysis results of attack methods output by the output device 400 are displayed, for example, as shown in FIG. 20 . The first similarity, second similarity, and third similarity between the protected asset to be analyzed (new protected asset) and the protected asset for which attack methods have been analyzed are displayed. Furthermore, as shown in FIG. 21 , weightings are set for the first similarity, second similarity, and third similarity, and priorities of the first similarity, second similarity, and third similarity are specified. In accordance with the priorities, attack methods against the protected asset to be analyzed identified from attack methods associated with the protected asset of the first similarity, attack methods against the protected asset to be analyzed identified from attack methods associated with the protected asset of the second similarity, and attack methods against the protected asset to be analyzed identified from attack methods associated with the protected asset of the third similarity are displayed.

[0065] 22, information about the process of modifying the attack method content included in the attack method analysis process information 222 is displayed together with the analysis results of the attack method and the attack method content. Sub-IDs are assigned appropriately depending on the content of the modification. The information about the process of modifying the attack method content and the sub-ID can, for example, show the user the analysis results of the attack method and the likelihood of the attack method content.

[0066] For example, in order to comply with legal regulations, automobile manufacturers and parts suppliers to automobile manufacturers must conduct vulnerability analysis in accordance with the international standard ISO / SAE21434, which summarizes the requirements for ensuring vehicle security. Vulnerability analysis involves analyzing and identifying attack methods against the protection assets being analyzed. Vulnerability analysis requires man-hours proportional to the number of protection assets. The more protection assets there are, the more man-hours required to conduct vulnerability analysis. For example, the number of software protection assets will be greater than the number of system element protection assets.

[0067] On the other hand, in this embodiment, the processor 100 calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory 200. Based on the similarity, the processor 100 identifies an attack method against the protected asset to be analyzed from the attack methods associated with the protected asset stored in the memory 200. Therefore, as shown in FIGS. 23 and 24 , attack methods already analyzed for other similar protected assets can be reused to analyze attack methods against a new protected asset to be analyzed, thereby reducing the amount of work required to analyze cyberattacks. Furthermore, the analysis of cyberattack methods can be made non-personal, eliminating the need for specialized knowledge, and improving maintainability. Furthermore, as shown in FIG. 25 , the presence or absence of a cyberattack can be determined using attack methods already analyzed for other similar protected assets.

[0068] In this embodiment, the memory 200 stores a correspondence between the protection assets of the system elements and the protection assets of the software that constitutes the system elements. The processor 100 calculates a similarity based on the correspondence between the protection assets to be analyzed and the correspondence between the protection assets stored in the memory 200. Protection assets that have a correspondence between the protection assets of the system elements and the protection assets of the software that constitutes the system elements can be considered to be the same type of protection assets. Attack methods against the same type of protection assets are often the same. Therefore, by reusing attack methods that have already been analyzed for the corresponding protection assets in analyzing attack methods against a new protection asset to be analyzed, the amount of work required to analyze attack methods for cyber attacks can be reduced. Furthermore, because the number of protection assets for system elements is smaller than the number of protection assets for software, the amount of work required to analyze attack methods against the larger number of protection assets for software can be reduced by using attack methods that have already been analyzed for the protection assets of the system elements.

[0069] Furthermore, in this embodiment, the memory 200 stores a design document 212 of the protected asset. The processor 100 calculates the similarity based on a topic analysis of the design document 212 related to the protected asset to be analyzed and a topic analysis of the design document 212 related to the protected asset stored in the memory 200. A design document for the protected asset always exists. Therefore, for example, even if there is no protected asset in common between a system element corresponding to the protected asset of the software to be analyzed and a system element corresponding to the protected asset stored in the memory 200, the similarity can be calculated.

[0070] Furthermore, in this embodiment, the memory 200 stores a tree structure T in which a protected asset belongs to a classification cl based on any node N in the tree structure T, and the classification cl changes from a higher-level classification cl to a lower-level classification cl as the protected asset reaches a lower level from a higher-level classification cl to a lower-level classification cl as the protected asset reaches a higher-level classification cl as the protected asset reaches a lower level from a higher-level classification cl. The processor 100 calculates a similarity based on the distance between the node N of the classification cl to which the protected asset to be analyzed belongs and the node N of the classification cl to which the protected asset stored in the memory 200 belongs. The tree structure T and the classification cl based on the tree structure T can be determined arbitrarily. Therefore, for example, even if there is no protected asset in common between a system element corresponding to the protected asset of the software to be analyzed and a system element corresponding to the protected asset stored in the memory 200, the similarity can be calculated.

[0071] Furthermore, in this embodiment, the processor 100 calculates the similarity between the protected asset to be analyzed and each of the multiple protected assets stored in the memory 200, and identifies, as the attack method against the protected asset to be analyzed, the attack method associated with the protected asset that has the highest similarity to the protected asset to be analyzed among the multiple protected assets stored in the memory 200. Therefore, it is possible to identify the most likely attack method by using attack methods that have already been analyzed for the multiple protected assets.

[0072] Furthermore, in this embodiment, the processor 100 maximizes the similarity of a protected asset that has a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200, among the multiple protected assets stored in the memory 200. The processor 100 identifies the attack method associated with the protected asset with the highest similarity among the multiple protected assets stored in the memory 200 as an attack method against the protected asset to be analyzed. Protected assets that have a system element corresponding to the protected asset to be analyzed and a system element corresponding to the protected asset stored in the memory 200 can be considered to be protected assets of the same type. Therefore, by identifying an attack method that has already been analyzed for a protected asset of the same type as an attack method against the protected asset to be analyzed, it is possible to identify the most likely attack method.

[0073] Furthermore, in this embodiment, the processor 100 increases the similarity of a protected asset, among the multiple protected assets stored in the memory 200, that has the smallest difference between the topic composition ratio in the topic analysis of the design document 212 related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document 212 related to the protected asset stored in the memory 200. The processor 100 identifies, as the attack method against the protected asset to be analyzed, the attack method associated with the protected asset with the highest similarity among the multiple protected assets stored in the memory 200. Therefore, even if there is no protected asset in which a system element corresponding to the protected asset of the software to be analyzed is common to a system element corresponding to the protected asset stored in the memory 200, it is possible to calculate the similarity from the design documents 212 of the multiple protected assets and identify the most likely attack method.

[0074] Furthermore, in this embodiment, the memory 200 stores a tree structure T in which each of a plurality of protected assets belongs to a classification cl determined by any one of nodes N in the tree structure T. The processor 100 maximizes the similarity of a protected asset among the plurality of protected assets stored in the memory 200, the protected asset having the shortest distance between the node N of the classification cl to which the protected asset to be analyzed belongs and the node N of the classification cl to which the protected asset stored in the memory 200 belongs. The processor 100 identifies, as an attack method against the protected asset to be analyzed, an attack method associated with the protected asset having the highest similarity among the plurality of protected assets stored in the memory 200. Therefore, even if there is no protected asset in which a system element corresponding to the protected asset of the software to be analyzed is in common with a system element corresponding to the protected asset stored in the memory 200, it is possible to calculate the similarity from the tree structure T of the plurality of protected assets and identify the most likely attack method.

[0075] Furthermore, in this embodiment, the processor 100 specifies the priorities of the first similarity, the second similarity, and the third similarity based on information received from the user via the input device 300. The processor 100 causes the output device 400 to output, in accordance with the priorities, an attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the first similarity, an attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the second similarity, and an attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the third similarity. Thus, the output device 400 can output, in accordance with the priorities input by the user, attack methods against the protected asset of the analysis target identified by various methods.

[0076] Furthermore, in this embodiment, when there is a protected asset among the multiple protected assets stored in the memory 200 in which a system element corresponding to the protected asset to be analyzed is in common with a system element corresponding to the protected asset stored in the memory, the processor 100 identifies, among the multiple protected assets stored in the memory 200, an attack method associated with a protected asset of the first similarity as an attack method against the protected asset to be analyzed. By identifying attack methods associated with the same type of protected asset as attack methods against the protected asset to be analyzed as described above, it is possible to identify an attack method with the highest probability.

[0077] On the other hand, when there is no protected asset among the multiple protected assets stored in the memory 200 in which a system element corresponding to the protected asset to be analyzed is common to a system element corresponding to the protected asset stored in the memory, the processor 100 identifies, among the multiple protected assets stored in the memory 200, the attack method associated with the protected asset with the second degree of similarity and the attack method associated with the protected asset with the third degree of similarity as the attack method against the protected asset to be analyzed. Therefore, even when there is no protected asset in which a system element corresponding to the protected asset to be analyzed is common to a system element corresponding to the protected asset stored in the memory, it is possible to identify the attack method with the highest probability.

[0078] The present invention is not limited to the above-described embodiments, and various design modifications can be made without departing from the spirit of the present invention as defined in the claims. For example, the above-described embodiments have been described in detail to facilitate understanding of the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configurations of the above-described embodiments with other configurations, and it is also possible to add other configurations to the configurations of the above-described embodiments. Furthermore, it is possible to add, delete, or replace other configurations with part of the configurations of the above-described embodiments.

[0079] REFERENCE SIGNS LIST 100 Processor 110 Control unit 120 Memory 130 Communication unit 140 Analysis target identification unit 150 Protected asset similarity calculation unit 160 Attack method identification unit 200 Memory 210 Protected asset information 211 Correspondence relationship 212 Design document 213 Hierarchical classification 214 Classification relationship 215 Configuration information 220 Attack method analysis result 221 Attack method 222 Attack method analysis process information 300 Input device 400 Output device 500 Network 600 Attack method analysis support device T Tree structure N Node L Link cl Classification ab Attribute

Claims

1. An attack method analysis support device comprising a processor and a memory, wherein the memory stores a protected asset, which is any one of a function of a system element constituting an information processing system, data processed by the function of the system element, a function of software constituting the system element, and the data processed by the function of the software, in association with an attack method of a cyber attack against the protected asset, and the processor identifies the protected asset to be analyzed based on information received from a user via an input device, calculates the similarity between the protected asset to be analyzed and the protected asset stored in the memory, identifies the attack method against the protected asset to be analyzed from the attack methods associated with the protected assets stored in the memory based on the similarity, and outputs the identified attack method against the protected asset to be analyzed to an output device.

2. The attack method analysis support device according to claim 1, characterized in that the memory stores a correspondence between the protected asset of the system element, which is either the function of the system element or the data processed by the function of the system element, and the protected asset of the software, which is either the function of the software constituting the system element or the data processed by the function of the software, and the processor determines the similarity based on the correspondence of the protected asset to be analyzed and the correspondence of the protected asset stored in the memory.

3. The attack method analysis support device according to claim 1, characterized in that: the memory stores design documents of the protected assets; and the processor determines the similarity based on a topic analysis of the design documents related to the protected assets to be analyzed and a topic analysis of the design documents related to the protected assets stored in the memory.

4. The attack method analysis support device according to claim 1, characterized in that the memory stores the tree structure in which the protected asset belongs to a classification based on one of the nodes in the tree structure, and the classification changes from a higher-level concept to a lower-level concept as the protected asset reaches a lower-level node connected by links from a higher-level node, and the processor calculates the similarity based on the distance between the node of the classification to which the protected asset to be analyzed belongs and the node of the classification to which the protected asset stored in the memory belongs.

5. The attack method analysis support device according to claim 1, characterized in that the memory stores a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other, and the processor calculates the similarity between the protected asset to be analyzed and each of the plurality of the protected assets stored in the memory, and identifies the attack method associated with the protected asset that has the highest similarity to the protected asset to be analyzed, among the plurality of the protected assets stored in the memory, as the attack method against the protected asset to be analyzed.

6. The attack method analysis support device according to claim 2, wherein the memory stores a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other, stores the correspondence between the plurality of the protected assets of the system element and the protected assets of the software that constitutes the system element, and the processor maximizes the similarity of a protected asset among the plurality of protected assets stored in the memory that has the same system element that is in the corresponding relationship with the protected asset of the analysis target and the system element that is in the corresponding relationship with the protected asset stored in the memory, and identifies the attack method associated with the protected asset that has the highest similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset of the analysis target.

7. The attack method analysis support device according to claim 3, wherein the memory stores a plurality of the protected assets and the attack methods for the plurality of the protected assets in association with each other, and stores the design documents for the plurality of the protected assets, and the processor increases the similarity of the protected asset among the plurality of the protected assets stored in the memory that has the smallest difference between the topic composition ratio in the topic analysis of the design document related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory, and identifies the attack method associated with the protected asset with the highest similarity among the plurality of the protected assets stored in the memory as the attack method against the protected asset to be analyzed.

8. The attack method analysis support device according to claim 4, wherein the memory stores a plurality of the protected assets in association with the attack methods for the plurality of the protected assets, stores the tree structure in which each of the plurality of protected assets belongs to the classification defined by any of the nodes in the tree structure, and the processor increases the similarity of a protected asset among the plurality of protected assets stored in the memory that has the shortest distance between the node of the classification to which the protected asset to be analyzed belongs and the node of the classification to which the protected asset stored in the memory belongs, and identifies the attack method associated with the protected asset with the highest similarity among the plurality of protected assets stored in the memory as the attack method against the protected asset to be analyzed.

9. The memory stores a plurality of the protected assets in association with the attack methods of the plurality of the protected assets, stores a correspondence between the protected asset of the system element, which is either the function of the system element or the data processed by the function of the system element, and the protected asset of the software, which is either the function of the software constituting the system element or the data processed by the function of the software, stores design documents of the plurality of the protected assets, and stores the tree structure in which each of the plurality of protected assets belongs to a classification based on any node in the tree structure, and the classification changes from a higher-level concept to a lower-level concept as the node linked from the higher-level node to the lower-level node, the processor sets the similarity of the protected asset, among the plurality of the protected assets stored in the memory, that is common between the system element in the corresponding relationship with the protected asset to be analyzed and the system element in the corresponding relationship with the protected asset stored in the memory as a first similarity, Among the plurality of protected assets stored in the memory, the attack method associated with the protected asset of the first similarity is identified as the attack method against the protected asset of the analysis target; Among the plurality of protected assets stored in the memory, the similarity of the protected asset having the smallest difference between the topic composition ratio in the topic analysis of the design document related to the protected asset of the analysis target and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory is set as a second similarity; Among the plurality of protected assets stored in the memory, the attack method associated with the protected asset of the second similarity is identified as the attack method against the protected asset of the analysis target; Among the plurality of protected assets stored in the memory, the similarity of the protected asset having the shortest distance between the node of the classification to which the protected asset of the analysis target belongs and the node of the classification to which the protected asset stored in the memory belongs is set as a third similarity; Among the plurality of protected assets stored in the memory, the attack method associated with the protected asset of the third similarity is identified as the attack method against the protected asset of the analysis target;2. The attack method analysis support device according to claim 1, further comprising: determining a priority order of the first similarity, the second similarity, and the third similarity based on information received from a user via an input device; and outputting to an output device, in accordance with the priority order, the attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the first similarity, the attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the second similarity, and the attack method against the protected asset of the analysis target identified from the attack methods associated with the protected asset of the third similarity.

10. The memory stores a plurality of the protected assets in association with the attack methods of the plurality of the protected assets, stores a correspondence between the protected asset of the system element, which is either the function of the system element or the data processed by the function of the system element, and the protected asset of the software, which is either the function of the software constituting the system element or the data processed by the function of the software, stores design documents of the plurality of the protected assets, and stores the tree structure in which each of the plurality of protected assets belongs to a classification based on a node in the tree structure, and the classification changes from a higher-level concept to a lower-level concept as it reaches the lower nodes connected by links from the higher-level node, and the processor, when there is a protected asset among the plurality of protected assets stored in the memory that has a common system element that is in a corresponding relationship with the protected asset to be analyzed and a system element that is in a corresponding relationship with the protected asset stored in the memory, the similarity between the protected asset that has the system element in the corresponding relationship with the protected asset to be analyzed and the system element in the corresponding relationship with the protected asset stored in the memory is set as a first similarity; among the multiple protected assets stored in the memory, the attack method associated with the protected asset with the first similarity is identified as the attack method against the protected asset to be analyzed; when there is no protected asset among the multiple protected assets stored in the memory that has the system element in the corresponding relationship with the protected asset to be analyzed and the system element in the corresponding relationship with the protected asset stored in the memory in common, the similarity of the protected asset among the multiple protected assets stored in the memory that has the smallest difference between the topic composition ratio in the topic analysis of the design document related to the protected asset to be analyzed and the topic composition ratio in the topic analysis of the design document related to the protected asset stored in the memory is set as a second similarity;the similarity of the protected asset having the shortest distance between the node of the classification to which the protected asset to be analyzed belongs and the node of the classification to which the protected asset stored in the memory belongs is set as a third similarity; and the attack method associated with the protected asset having either the second similarity or the third similarity among the protected assets stored in the memory is identified as the attack method against the protected asset to be analyzed.

Images