Analysis assistance system and analysis assistance method

Abstract

In the present invention, for each of a plurality of waterfall-type steps constituting an analysis process, generation rule data representing a generation rule for generating step result data representing a result of the step is stored. For each of the plurality of steps, a generation rule corresponding to the step defines a processing method for data included in step result data of a previous step of said step. This analysis assistance system executes steps in the step order. In the execution of each of the steps, the analysis assistance system: acquires generation rule data corresponding to the step, and step result data of a previous step of said step; generates step result data as a step result for the step by using the step result data acquired for the previous step in accordance with a generation rule represented by the acquired generation rule data; and stores the generated step result data.

Description

Analysis support system and analysis support method

[0001] The present invention generally relates to data processing techniques for analytical support.

[0002] Known techniques relating to analysis support include, for example, the technique disclosed in Patent Document 1. Patent Document 1 discloses a threat analysis support system that can support the analysis of threats in information security.

[0003] Japanese Patent Application Laid-Open No. 2022-101716

[0004] Security analysis tends to require more and longer analysis time as the system being analyzed (for example, a computer system implemented for a customer) becomes more complex. In particular, in cases where at least one of the following applies, the amount of work required to respond increases, which can put pressure on the process and reduce customer satisfaction. - During the analysis, there are changes in the configuration or analysis requirements due to customer requests. - Re-analysis is required when changes occur during operation after the system is released (for example, specification changes or function updates). - The project has continuity, so past analysis results need to be utilized. - The analysis target is continually updated through DevOps, so repeated analysis is required.

[0005] The security analysis process is a waterfall type where the results (output) of the previous process are the input for the next process, so even a small change in an early process can have a big impact on the results of later processes, making trial and error in the analysis difficult.

[0006] This problem can occur not only in security analysis but also in other analyses in which the results of the previous process are input to the next process, such as vulnerability analysis.

[0007] For each of a plurality of waterfall-type processes constituting an analysis process, generation rule data representing a generation rule for generating process result data representing the results of that process is stored. For each of the plurality of processes, the generation rule corresponding to that process specifies a method for processing data included in the process result data of the process preceding that process. The analysis support system performs the processes in order of the processes, and in performing each process, acquires the generation rule data corresponding to that process and the process result data of the process preceding that process, generates process result data as the process result for that process using the process result data acquired for the previous process in accordance with the generation rule represented by the acquired generation rule data, and stores the generated process result data.

[0008] According to the present invention, trial and error analysis can be easily performed.

[0009] 1 is a schematic diagram of the flow of security analysis according to an embodiment. A configuration diagram of an entire system including an analysis support system according to an embodiment. A flowchart of the flow of security analysis. A diagram of an example of a definition of an analysis target. A diagram of an example of a first generation rule. A diagram of a module function list. A diagram of an example of a second generation rule. A diagram of a threat scenario list. A diagram of an example of a third generation rule. A diagram of a damage scenario list. A diagram of an example of a fourth generation rule. A diagram of a threat-risk list. A diagram of an example of a fifth generation rule. A diagram of a grouping threat list. A diagram of an example of a sixth generation rule. A diagram of a threat-FT list. A diagram of an example of a seventh generation rule. A diagram of a countermeasure policy list. A diagram of an eighth generation rule. A diagram of a security functional requirement list. A schematic diagram of visualization and updating. A flowchart of the flow of the analysis process after updating.

[0010] In the following description, an "interface device" may be one or more interface devices. The one or more interface devices may be at least one of the following: - An I / O interface device that is one or more I / O (Input / Output) interface devices. The I / O (Input / Output) interface device is an interface device for at least one of an I / O device and a remote display computer. The I / O interface device for the display computer may be a communication interface device. The at least one I / O device may be a user interface device, for example, either an input device such as a keyboard and a pointing device, or an output device such as a display device. - A communication interface device that is one or more communication interface devices. The one or more communication interface devices may be one or more homogeneous communication interface devices (e.g., one or more NICs (Network Interface Cards)) or two or more heterogeneous communication interface devices (e.g., a NIC and an HBA (Host Bus Adapter)).

[0011] In the following description, "memory" refers to one or more memory devices, which are an example of one or more storage devices, and may typically be a primary storage device. At least one memory device in the memory may be a volatile memory device or a non-volatile memory device.

[0012] In the following description, a "persistent storage device" may refer to one or more persistent storage devices, which are an example of one or more storage devices. A persistent storage device may typically be a non-volatile storage device (e.g., an auxiliary storage device), and more specifically, may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVME) drive, or a storage class memory (SCM).

[0013] In the following description, the term "storage device" may refer to at least one of memory and persistent storage device.

[0014] In the following description, a "processor" may refer to one or more processor devices. The at least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also be another type of processor device such as a GPU (Graphics Processing Unit). The at least one processor device may be a single-core or multi-core. The at least one processor device may also be a processor core. At least one processor device may be a processor device in a broad sense, such as a circuit that is a collection of gate arrays written in a hardware description language that performs some or all of the processing (for example, an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0015] In the following description, functions may be described using the expression "yyy unit." However, the functions may be realized by one or more computer programs executed by a processor, by one or more hardware circuits (e.g., FPGAs or ASICs), or by a combination thereof. When a function is realized by a program executed by a processor, the specified processing is performed using a storage device and / or an interface device, etc., as appropriate, and therefore the function may be considered to be at least a part of the processor. Processing described using a function as the subject may be processing performed by a processor or a device having the processor. A program may be installed from a program source. The program source may be, for example, a program distribution computer or a computer-readable storage medium (e.g., a non-transitory storage medium). The description of each function is an example; multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0016] In the following description, when elements of the same type are described without distinction, common reference symbols are used, and when elements of the same type are described with distinction, reference symbols are used.

[0017] An embodiment of the present invention will be described below.

[0018] FIG. 1 is a schematic diagram of the flow of security analysis according to an embodiment.

[0019] Regarding security analysis, the flow consisting of multiple steps S1 to S8 is a waterfall type flow, in which the result (output) of the previous step is the input of the next step.

[0020] Each process is associated with a generation rule 101 that enables the process (the next process relative to the previous process) to automatically generate a result using the result of the previous process as input. The generation rule 101 is data representing a generation rule for automatically generating a result. In each process, the process result 102 of the previous process is used as input data in accordance with the generation rule 101 associated with the process to generate the process result 102 of the process. For each process, the process result 102 is data representing the result of the process.

[0021] 1, there are eight processes S1 to S8, which means there are first to eighth generation rules 101A to 101H and first to eighth process results 102A to 102H. In the first process S1, the analysis target 100 is the input data. The analysis target 100 is data that represents the analysis target. The analysis target 100, processes S1 to S8, first to eighth generation rules 101A to 101H, and first to eighth process results 102A to 102H will be described in detail later.

[0022] The generation rules 101A-101H may be physically separated data or logically separated data (e.g., eight generation rules may be written in one file).Similarly, the process results 102A-102H may be physically separated data or logically separated data (e.g., eight process results may be written in one file).

[0023] Furthermore, at least a portion of the generation rules 101A to 101H may be logic data generated by a generation AI.

[0024] FIG. 2 is a diagram showing the overall configuration of a system including an analysis support system according to an embodiment.

[0025] A user terminal 240 is communicatively connected to the analysis support system 200, for example, via a communication network 270. For example, the user terminal 240 may be an input / output console (for example, a client device) of the analysis support system 200.

[0026] An external system 250 other than the user terminal 240 may be communicably connected to the analysis support system 200, for example, via a communication network 270. The external system 250 may be a system that serves as a source of some of the input data for at least one of the multiple processes S1 to S8 performed by the analysis support system 200, or may be a system that performs processing using at least some of the process results 102 of at least one of the multiple processes S1 to S8 as input data.

[0027] In this embodiment, the analysis support system 200 is a physical computer system (one or more physical computers) and includes an interface device 201, a storage device 202, and a processor 203 connected to them. The analysis support system 200 may also be a logical computer system (for example, a virtual machine or a cloud computing system) based on the physical computer system.

[0028] Communication with a user terminal 240 is performed through the interface device 201 .

[0029] The storage device 202 stores data and programs. As data, a generation rule DB 221 and a process result DB 222 are stored. The generation rule DB 221 is a database in which generation rules 101A to 101H are stored. The process result DB 222 is a database in which process results 102A to 102H are stored.

[0030] The processor 203 executes the programs stored in the storage device 202 to realize functions such as an input unit 231, a calculation unit 232, and an output unit 233. For each of steps S1 to S8, each function performs the following processing. That is, the input unit 231 acquires the process result 102 of the previous step from the process result DB 222, and acquires the generation rule 101 associated with the step from the generation rule DB 221. The calculation unit 232 performs a calculation for the step using the acquired generation rule 101 and the process result 102 of the previous step. The output unit 233 stores the process result 102 as a result of the calculation in the process result DB 222.

[0031] FIG. 3 is a flowchart of the security analysis process.

[0032] First, an initial input S0 is performed. In the initial input S0, the input unit 231 accepts input for the analysis target 100 from the user terminal 240 (or another data source), and the output unit 233 stores the analysis target 100 in the process result DB 222. The analysis target 100 is represented according to predetermined rules. For example, as shown in FIG. 4 , the analysis target 100 defines the protection scope as a rectangle, modules (ECU1 to ECU4) as double circles, communication connections as lines between modules and lines from outside the protection scope to modules, and entry points (interfaces for ECU1 and ECU2) as circles. Furthermore, the analysis target 100 includes data representing one or more protected assets (e.g., data representing the asset name or type of the protected asset) for each module. Types of protected assets include "data" and "function." These definitions make it possible to identify the protection scope, entry points, modules, and protected assets from the analysis target 100.

[0033] Next, the first process S1 is performed. In the first process S1, the input unit 231 obtains the first generation rule 101A associated with the first process S1 from the generation rule DB 221, and obtains the analysis target 100 for the initial input S0 (the process result of the previous process for the first process S1) from the process result DB 222. The calculation unit 232 generates a module function list 102A, which is the first process result 102A, using the analysis target 100 in accordance with the first generation rule 101A. The output unit 233 stores the module function list 102A in the process result DB 222.

[0034] 5 shows an example of the first generation rule 101A. The first generation rule 101A may be a rule related to the CIA definition, i.e., a rule related to the definitions of Confidentiality, Integrity, and Availability, and may include, for example, an estimation rule for a protection viewpoint for each type of protected asset and an estimation rule for a type of protected asset from the asset name of the protected asset. According to the first generation rule 101A, when the type of protected asset of a module is identified from the analysis target 100, the calculation unit 232 estimates a protection viewpoint corresponding to the type from the estimation rule for the protection viewpoint corresponding to the type, and determines the estimated protection viewpoint as the protection viewpoint of the protected asset. Furthermore, according to the first generation rule 101A, when the asset name of a protected asset of a module is identified from the analysis target 100, the calculation unit 232 estimates the type of the protected asset from the asset name (for example, if the asset name ends with "data," the type is estimated to be "data"), estimates a protection viewpoint corresponding to the estimated type from the protection viewpoint estimation rule corresponding to the type, and determines the estimated protection viewpoint as the protection viewpoint of the protected asset. As a result of such calculation, a module function list 102A illustrated in FIG. 6 is generated, i.e., data representing a module name 601, a protected asset name 602, and a protection viewpoint 603 for each module.

[0035] The second process S2 is performed after the first process S1. In the second process S2, the input unit 231 acquires a second generation rule 101B associated with the second process S2 from the generation rule DB 221, and acquires a module function list 102A (the process result 102A of the process preceding the second process S2) and the analysis target 100 from the process result DB 222. The calculation unit 232 generates a threat scenario list 102B, which is the second process result 102B, using the module function list 102A and the analysis target 100 in accordance with the second generation rule 101B. The output unit 233 stores the threat scenario list 102B in the process result DB 222.

[0036] Specifically, for example, the second generation rule 101B is as shown in FIG. 7 . According to the second generation rule 101B, a threat scenario is generated for each protected asset in accordance with the 5Ws (Who, Where, When, Why, and What). The second generation rule 101B also specifies one or more possible scenario components (scenario components as constituent elements of a threat scenario) for each of the 5Ws. In accordance with the second generation rule 101B, the calculation unit 232 generates multiple threat scenarios for each protected asset identified from the module function list 102A, using all possible combinations of the 5W scenario components. As a result of this calculation, a threat scenario list 102B as shown in FIG. 8 is generated, i.e., data representing a protected asset 801, 5Ws 802-806, and a generated threat scenario 807 for each protected asset. The second generation rule 101B specifies, for each protected asset, the scenario components that can or cannot be taken when the protection perspective is associated with the protected asset, and the generation of a threat scenario for the protected asset may be performed based on the protection perspective corresponding to the protected asset and the second generation rule 101B.

[0037] The third process S3 is performed after the first process S1. The third process S3 may be performed before or after the second process S2, or may be performed in parallel with the second process S2. In the third process S3, the input unit 231 acquires a third generation rule 101C associated with the third process S3 from the generation rule DB 221 and acquires a module function list 102A (process result 102A of the process preceding the third process S3) from the process result DB 222. The calculation unit 232 generates a damage scenario list 102C, which is the third process result 102C, using the module function list 102A in accordance with the third generation rule 101C. The output unit 233 stores the damage scenario list 102C in the process result DB 222.

[0038] Specifically, for example, the third generation rule 101C is as shown in FIG. 9 . The third generation rule 101C may be a rule related to the automatic generation of a damage scenario template or a candidate. According to the third generation rule 101C, a damage scenario generation perspective and a damage scenario template for each generation perspective are specified for each protected asset. The calculation unit 232 generates a damage scenario for each damage scenario generation perspective for each protected asset identified from the module function list 102A in accordance with the third generation rule 101C. As a result of this calculation, the damage scenario list 102C illustrated in FIG. 10 is generated, i.e., data representing a protected asset 1001 (damage caused to the protected asset) and generation perspectives 1002 to 1005 regarding the damage (i.e., the impact of the damage for each generation perspective) is generated for each protected asset. In addition, the third generation rule 101C specifies, for each protection perspective, a damage scenario that may or may not occur when the protection perspective is associated with the protected asset, and the generation of a damage scenario for each generation perspective of the protected asset may be performed based on the protection perspective corresponding to the protected asset and the third generation rule 101C.

[0039] Following the second step S2 and the third step S3, a fourth step S4 is performed. In the fourth step S4, the input unit 231 acquires a fourth generation rule 101D associated with the fourth step S4 from the generation rule DB 221, and acquires a threat scenario list 102B (the process result 102B of the process preceding the fourth step S4) and a damage scenario list 102C (the process result 102C of the process preceding the fourth step S4) from the process result DB 222. The calculation unit 232 generates a threat-risk list 102D, which is the fourth process result 102D, using the threat scenario list 102B and the damage scenario list 102C in accordance with the fourth generation rule 101D. The output unit 233 stores the threat-risk list 102D in the process result DB 222.

[0040] Specifically, for example, the fourth generation rule 101D is as shown in FIG. 11 . According to the fourth generation rule 101D, a score calculation method using a damage scenario and a threat scenario is specified. For example, a method for calculating a score for an impact on an asset may be specified using one or more scenario components (e.g., words) in the damage scenario as variables. Also, a method for calculating a score for an attack susceptibility may be specified using one or more scenario components (e.g., words) in the threat scenario as variables. Also, a method for calculating a score for a risk may be specified using the score for the impact on the asset and the score for the attack susceptibility as variables. In accordance with the fourth generation rule 101D, the calculation unit 232 calculates, for each protected asset, a score for the impact on the asset, a score for the attack susceptibility, and a score for the risk using a threat scenario identified from the threat scenario list 102B and a damage scenario identified from the damage scenario list 102C. 12, that is, data is generated that represents, for each protected asset, a threat scenario 1201 (identified threat scenario), impact on asset 1202 (calculated score for impact on asset), ease of attack 1203 (calculated score for ease of attack), and risk 1204 (calculated score for risk). Each of the information 1201 to 1204 may be scored on a five-level scale (maximum value "5" and minimum value "1"), with larger values ​​being more negative and smaller values ​​being more positive.

[0041] The fifth step S5 is performed after the fourth step S4. In the fifth step S5, the input unit 231 obtains a fifth generation rule 101E associated with the fifth step S5 from the generation rule DB 221, and obtains a threat-risk list 102D (the process result 102D of the process preceding the fifth step S5) from the process result DB 222. The calculation unit 232 generates a grouped threat list 102E, which is the fifth process result 102E, using the threat-risk list 102D in accordance with the fifth generation rule 101E. The output unit 233 stores the grouped threat list 102E in the process result DB 222.

[0042] Specifically, for example, the fifth generation rule 101E is as shown in FIG. 13 . The fifth generation rule 101E prescribes a rule for classifying threat scenarios into groups. For example, each group may be associated with conditions related to perspectives such as the 5Ws, protection perspective, a score for impact on assets, a score for ease of attack, and a score for risk. In accordance with the fifth generation rule 101E, the calculation unit 232 classifies a threat scenario identified from the threat-risk list 102D into one of multiple groups (e.g., the group in which the threat scenario satisfies the most conditions). As a result of this calculation, the grouped threat list 102E illustrated in FIG. 14 is generated, i.e., data representing a threat scenario 1401 and a group 1402 for each threat scenario. Depending on the conditions associated with the groups in the fifth generation rule 101E, there may be conditions that cannot be identified from the explicit information in the threat-risk list 102D, but such conditions may be identified by inferring from the threat-risk list 102D or by referring to the process result 102 generated in a process prior to the fourth process S4. Furthermore, the fifth generation rule 101E may include a rule for merging multiple threat scenarios classified in the same group into one threat scenario, and in accordance with this rule, the multiple threat scenarios classified in the same group may be merged into one threat scenario, and in subsequent processes, this one threat scenario may be used for each group.

[0043] The sixth step S6 is performed after the fifth step S5. In the sixth step S6, the input unit 231 obtains a sixth generation rule 101F associated with the sixth step S6 from the generation rule DB 221, and obtains a grouping threat list 102E (the process result 102E of the process preceding the sixth step S6) from the process result DB 222. The calculation unit 232 generates a threat-FT list 102F, which is the sixth process result 102F, using the grouping threat list 102E in accordance with the sixth generation rule 101F. The output unit 233 stores the threat-FT list 102F in the process result DB 222.

[0044] Specifically, for example, the sixth generation rule 101F is as shown in FIG. 15 . The sixth generation rule 101F defines a rule (e.g., an FT template) for expanding a threat scenario (group) into an FT (Fault Tree), for example, the relationship between scenario components in a threat scenario and nodes in the FT. A node that is an element of the FT may represent some kind of threat, such as an attack or a failure. The sixth generation rule 101F may define, for each node that can be an element of the FT, a rule regarding whether an attack can be realized (e.g., the relationship with scenario components in the threat scenario). In accordance with the sixth generation rule 101F, the calculation unit 232 expands an FT from the threat scenario (group) identified from the grouped threat list 102E and determines whether an attack can be realized for each node in the FT. As a result of such calculations, a threat-FT list 102F as shown in FIG. 16 is generated, that is, data representing a threat scenario 1601, an FT 1602, and whether an attack can be carried out for each node in the FT 1603, for each threat scenario (group).

[0045] The seventh step S7 is performed after the sixth step S6. In the seventh step S7, the input unit 231 obtains the seventh generation rule 101G associated with the seventh step S7 from the generation rule DB 221, and obtains the threat-FT list 102F (the process result 102F of the process preceding the seventh step S7) from the process result DB 222. The calculation unit 232 generates the countermeasure policy list 102G, which is the seventh process result 102G, using the threat-FT list 102F in accordance with the seventh generation rule 101G. The output unit 233 stores the countermeasure policy list 102G in the process result DB 222.

[0046] Specifically, for example, the seventh generation rule 101G is as shown in FIG. 17 . The seventh generation rule 101G prescribes, for each threat (such as an attack) that may be a component of the FT of a threat scenario (group), a rule (e.g., a countermeasure template) for determining a countermeasure policy that can be taken against the threat. The countermeasure policy may be prescribed for each of whether the attack is feasible and whether the attack is not feasible. In accordance with the seventh generation rule 101G, the calculation unit 232 determines a countermeasure policy for each node in the FT of a threat scenario (group) identified from the threat-FT list 102F, for example, based on whether the attack corresponding to that node is feasible. As a result of such calculation, the countermeasure policy list 102G illustrated in FIG. 18 is generated, i.e., data representing a threat scenario 1801, an FT 1802, and a countermeasure policy 1803 for each node in the FT for each threat scenario (group).

[0047] Finally, the eighth step S8 is performed. In the eighth step S8, the input unit 231 obtains an eighth generation rule 101H associated with the eighth step S8 from the generation rule DB 221, and obtains a countermeasure policy list 102G (a process result 102G of the process preceding the eighth step S8) from the process result DB 222. The calculation unit 232 generates a security function requirement list 102H, which is an eighth process result 102H, using the countermeasure policy list 102G in accordance with the eighth generation rule 101H. The output unit 233 stores the security function requirement list 102H in the process result DB 222.

[0048] Specifically, for example, the eighth generation rule 101H is as shown in FIG. 19 . The eighth generation rule 101H prescribes, for each threat (e.g., attack) that may be a component of the FT of a threat scenario (group), a rule for determining security function requirements corresponding to the policy measures for the threat (e.g., a rule for selecting security functions corresponding to the policy measures). In accordance with the eighth generation rule 101H, the calculation unit 232 determines security function requirements (e.g., security functions necessary to realize the policy measures) for each node in the FT of a threat scenario (group) identified from the policy measures list 102G, based on the policy measures corresponding to the node. As a result of this calculation, the security function requirement list 102H illustrated in FIG. 20 is generated, i.e., data representing a threat scenario 2001, an FT 2002, and policy measures 2003 and security function requirements 2004 for each node in the FT, for each threat scenario (group).

[0049] The above is the flow of security analysis. In this flow, for at least one generation rule 101, at least a part of the process result 102 generated in accordance with the generation rule 101 may be generated using generation AI (e.g., text generation AI using a language model such as Large Language Models).

[0050] According to this embodiment, trial and error analysis can be facilitated. Specifically, security analysis can be automatically performed in an orderly manner according to preset rules, thereby realizing analysis support that is robust against changes in conditions, etc. Furthermore, for at least one process (e.g., each process), process result data may be output to the user terminal 240 by the output unit 233, i.e., the process results may be visualized. Furthermore, the generation rules may be updated as appropriate. This allows for trial and error and flexible application.

[0051] Although one embodiment has been described above, this is merely an example for explaining the present invention, and the scope of the present invention is not limited to this embodiment. The present invention can be implemented in various other forms.

[0052] The above-described embodiment can be summarized as follows: The following summary may include supplementary explanations and explanations of modifications to the above explanations.

[0053] The analysis support system (e.g., analysis support system 200) includes a storage device (e.g., storage device 202) and a processor (e.g., processor 203) connected to the storage device. The storage device stores generation rule data representing generation rules for generating process result data representing the results of each of a plurality of waterfall-type processes constituting the analysis process.

[0054] For each of a plurality of processes, the generation rule corresponding to that process defines a method for processing data included in the process result data of the previous process of that process. For example, for each process, a processing method (e.g., a regression equation) is defined in which data instances (e.g., values) in data items (e.g., columns) included in the process result data of the previous process of that process are used as variables (e.g., explanatory variables), and a data instance (e.g., a response variable) for a data item required in the process result data of that process is obtained by arithmetic processing according to that processing method.

[0055] The processor performs each step according to the order of the multiple steps (i.e., the order of the steps in a waterfall model), and in performing each step, performs the following (x): (x) acquires generation rule data corresponding to the step and process result data of the previous step of the step from the storage device, generates process result data as the process result for the step using the process result data acquired for the previous step in accordance with the generation rule represented by the acquired generation rule data, and stores the generated process result data in the storage device.

[0056] In this way, the analysis process is carried out automatically, which facilitates trial and error analysis.

[0057] The analysis support system may further include an interface device (e.g., interface device 201) connected to an information processing device (e.g., user terminal 240). The processor may output process result data for at least one of the multiple processes to the information processing device via the interface device. For example, as illustrated in FIG. 21 , the process results may be visualized by the analysis support system via the information processing device. Visualizing the process results can contribute to appropriate updating of the generation rules by the user. For example, the output unit 233 may output a process result 102 for at least one of the first to eighth processes (S1 to S8) in the above-described embodiment to the user terminal 240, and the process result represented by the process result 102 may be displayed on the display of the user terminal 240.

[0058] The processor may receive analysis target data (e.g., analysis target 100) representing an analysis target from an information processing device via an interface device and store the analysis target data in a storage device. In performing the first step, the processor identifies, in accordance with a generation rule represented by generation rule data corresponding to the first step, an element (e.g., a module) that satisfies a condition (e.g., a condition representing a module) defined in the generation rule from the analysis target data, processes data (e.g., a protection asset) identified from the analysis target data for the identified element in accordance with the generation rule (e.g., determines a protection perspective for the protection asset), generates process result data for the first step, and stores the process result data in a storage device. In this way, in the first step, process result data for the analysis target can be generated for the next step.

[0059] As illustrated in FIG. 21 , the processor may receive, from an information processing device through an interface device, updates to one or more processes, such as the process result data for the process, or the generation rule data corresponding to the process. A process in which the process itself, the process result data, or the generation rule data has been updated can be referred to as an "updated process." When there are one or more updated processes, the processor may identify the earliest updated process among the one or more updated processes (S2201), as illustrated in FIG. 22 , and perform the above-described (x) on the identified earliest updated process and each subsequent process (S2202). This facilitates trial and error analysis, even if one or more updated processes, including those that have already been performed, occur during or after the analysis process, because the earliest updated process and subsequent processes among the one or more updated processes are performed in the order of the processes.

[0060] The analysis process may be a security analysis or vulnerability analysis analysis process. For security analysis, the multiple steps may include at least one of the following first to eighth steps. For example, the third step related to damage scenarios and the fifth step related to grouping threat scenarios may be omitted. For vulnerability analysis, by replacing "threat" in security analysis with "vulnerability" and adapting at least one of the following first to eighth steps to suit vulnerability analysis, it is possible to automatically perform vulnerability analysis in addition to security analysis. The first step is to generate first process result data related to one or more protected assets for each module of the analysis target represented by the analysis target data, in accordance with first generation rule data corresponding to the first step. The second step is to generate second process result data representing threat scenarios related to threats to the protected assets, using the first process result data, in accordance with second generation rule data corresponding to the second step. The third step is a step of generating third process result data representing a damage scenario related to damage to the protected asset using the first process result data in accordance with third generation rule data corresponding to the third step. The fourth step is a step of generating fourth process result data representing a score for each of one or more perspectives using at least second process result data of the second and third process result data in accordance with fourth generation rule data corresponding to the fourth step. The fifth step is a step of generating fifth process result data representing a group of threat scenarios using the fourth process result data in accordance with fifth generation rule data corresponding to the fifth step. The sixth step is a step of generating sixth process result data related to a Fault Tree (FT) of the threat scenario using the fifth process result data in accordance with sixth generation rule data corresponding to the sixth step. The seventh step is a step of generating seventh step result data related to the countermeasure policies for each element of FT of the threat scenario using the sixth step result data in accordance with seventh generation rule data corresponding to the seventh step. The eighth step is a step of generating eighth step result data related to the security function requirements for each element of FT of the threat scenario using the seventh step result data in accordance with eighth generation rule data corresponding to the eighth step.

[0061] 101: Generation rules, 102: Process results, 200: Analysis support system

Claims

1. An analysis support system comprising: a storage device; and a processor connected to the storage device, wherein the storage device stores, for each of a plurality of waterfall-type processes constituting an analysis process, generation rule data representing a generation rule for generating process result data representing the result of that process; for each of the plurality of processes, the generation rule corresponding to that process specifies a method for processing data included in the process result data of the process preceding that process; and the processor performs each process in accordance with the order of the plurality of processes, and in performing each process, performs the following (x): (x) acquires from the storage device the generation rule data corresponding to that process and the process result data of the process preceding that process, and generates process result data as a process result for that process using the process result data acquired for the preceding process in accordance with the generation rule represented by the acquired generation rule data, and stores the generated process result data in the storage device.

2. The analysis support system according to claim 1, further comprising an interface device connected to an information processing device, wherein the processor outputs process result data for at least one of the plurality of processes to the information processing device via the interface device.

3. An interface device connected to an information processing device, wherein the processor receives analysis target data representing an analysis target from the information processing device through the interface device and stores the analysis target data in the storage device, and in carrying out a first step, the processor identifies from the analysis target data elements that meet the conditions specified in the generation rules represented by the generation rule data corresponding to the first step, processes data identified from the analysis target data for the identified elements in accordance with the generation rules, generates process result data for the first step, and stores the process result data in the storage device.

4. An interface device connected to an information processing device, wherein the processor receives, from the information processing device through the interface device, updates to one or more processes, the process itself, the process result data for the process, or the generation rule data corresponding to the process, and when there are one or more update processes in which the process itself, the process result data, or the generation rule data has been updated, the processor identifies the earliest update process of the one or more update processes, and performs (x) for the identified earliest update process and each process thereafter.

5. The analysis support system according to claim 1, wherein the analysis process is a security analysis or vulnerability analysis process.

6. An analysis support method performed by a computer, which includes: storing, in a storage device, generation rule data representing generation rules for generating process result data representing the results of each of a plurality of waterfall-type processes that make up an analysis process; for each of the plurality of processes, the generation rule corresponding to that process specifies a method for processing data included in the process result data of the process preceding that process; and performing the following (x) for each process in order of processes: (x) acquiring from the storage device the generation rule data corresponding to that process and the process result data of the process preceding that process, and generating process result data as the process result for that process using the process result data acquired for the preceding process in accordance with the generation rule represented by the acquired generation rule data, and storing the generated process result data in the storage device.

Images