JP7441719B2 - Incident information analysis device, analysis method, and analysis program - Google Patents

Description

The present invention relates to a technique for analyzing incident information.

In recent years, various information processing devices have been used as the information society progresses. These information processing devices are exposed to the threat of various attacks every day. Since much of the recent information society is controlled by such information processing devices, attacks on corporate information processing systems and social infrastructure systems can have a large impact.

However, if appropriate countermeasures are applied before or during an attack, depending on the configuration of the information processing device that may be the target of the attack, it is possible to prevent the attack or minimize the damage. There are many cases.

Patent Document 1 discloses that the effectiveness of each security measure on the entire large-scale system is calculated from information on components included in the attack path of a threat item and the effectiveness value of the security measure. has been done.

Japanese Patent Application Publication No. 2018-77597

Information related to attacks on information processing devices (incident information) may exist on the Internet or SNS (Social Networking Service). By utilizing such incident information, weaknesses in information processing equipment and effective countermeasures may be discovered. Therefore, for example, within organizations such as companies, PSIRT (Product Security Incident Response Team) collects incident information related to attacks on information processing equipment from the Internet and SNS, analyzes it, and uses it to improve information processing equipment. It is used to help maintain security.

However, because the configurations of information processing devices targeted by attacks vary, and the content and expression of incident information also vary, analysts need specialized knowledge to analyze incident information and obtain useful information. It is demanding and the work takes a long time.

One purpose of the present disclosure is to provide technology that supports analysis of incident information.

An incident information analysis device according to one aspect of the present disclosure includes an element identification unit that extracts a word from a sentence of incident information and identifies an element of an information processing device corresponding to the word; an attack route identification unit that identifies an attack route followed by the attack indicated in the incident information based on a combination of the corresponding elements; and a configuration estimation unit that estimates configuration information regarding a system configuration of the processing device.

According to one aspect of the present disclosure, it is possible to support analysis of incident information.

FIG. 1 is a block diagram of an incident information analysis system according to an embodiment. FIG. 2 is a block diagram showing the configuration of the incident information analysis device shown in FIG. 1. FIG. FIG. 3 is a sequence diagram showing the overall processing of the incident information analysis system shown in FIGS. 1 and 2. FIG. 3 is a flowchart for explaining an incident information analysis method in the incident information analysis system shown in FIGS. 1 and 2. FIG. 2 is a diagram showing an example of an incident information input screen displayed on the input device shown in FIG. 1. FIG. 5 is a flowchart for explaining element identification processing in the element identification unit shown in FIG. 4. FIG. 3 is a diagram showing an example of the security element database shown in FIG. 2. FIG. 5 is a flowchart for explaining attack route identification processing in the attack route identification unit shown in FIG. 4. FIG. 3 is a diagram showing an example of the attack path definition database shown in FIG. 2. FIG. 5 is a flowchart for explaining configuration estimation processing in the configuration estimation section shown in FIG. 4. FIG. 3 is a diagram showing an example of the product configuration database shown in FIG. 2. FIG. FIG. 3 is a diagram showing a configuration identification result output screen output from the configuration estimation unit via the output unit. 5 is a flowchart for explaining configuration comparison processing in the configuration comparison section shown in FIG. 4. FIG. FIG. 3 is a diagram showing an example of the in-house product database shown in FIG. 2; 3 is a diagram showing an example of an in-house product configuration input screen when registering the system configuration of an in-house product in the in-house product database shown in FIG. 2. FIG. 3 is a flowchart for explaining countermeasure presentation processing in the countermeasure presentation unit shown in FIG. 2. FIG. 3 is a diagram showing an example of the countermeasure database shown in FIG. 2. FIG. It is a figure which shows the impact determination result output screen outputted from a countermeasure presentation part via an output part.

Embodiments of the present invention will be described below with reference to the drawings. Note that in the following specification of this application, elements include hardware such as component parts, interfaces, and communication channels included in the information processing device, software such as applications and tools, data such as personal information and calculation results, etc. shows. Further, the attack route is a route followed by an attack on the information processing device, and is indicated by elements and their order. For example, in an attack that accesses a server and ingests or alters personal information on the server's memory, the target personal information is reached through several elements from the first accessed element. In that case, the elements existing from the access destination element to the target element (personal information) and their order indicate the attack route. Further, the configuration information is a configuration indicating the elements included in the information processing device and the mutual relationships among the elements, and is indicated by the elements and the connections between the elements.

FIG. 1 is a block diagram of an incident information analysis system according to an embodiment. As shown in FIG. 1, the incident information analysis system according to this embodiment includes an input device 11, an output device 12, and an incident information analysis device 13, and the input device 11 and the output device 12 are accessible by a user 90. It is configured. The input device 11 is used by the user 90 to input incident information and company product configuration information into the incident information analysis device 13. The output device 12 is for presenting and outputting the configuration identification results and impact determination results from the incident information analysis device 13 to the user 90.

FIG. 2 is a block diagram showing the configuration of the incident information analysis device 13 shown in FIG. 1. As shown in FIG. As shown in FIG. 2, the incident information analysis device 13 shown in FIG. 306, a countermeasure presentation section 307, a security element database 308, an attack path definition database 309, a product configuration database 310, an in-house product database 311, and a countermeasure database 312.

The input unit 301 receives incident information and in-house product configuration information input by the user 90 via the input device 11.

The output unit 302 outputs the configuration identification results and the influence determination results to the output device 302.

The element identification unit 303 extracts words from the text of the incident information received by the input unit 301, and identifies the element of the information processing device corresponding to the extracted word.

Based on the combination of elements identified by the element identification unit 303, the attack route identification unit 304 identifies the attack route followed by the attack indicated in the incident information from which words corresponding to the elements have been extracted.

The configuration estimating unit 305 estimates configuration information regarding the system configuration of the information processing device based on the elements identified by the element identifying unit 303 and the attack route identified by the attack route identifying unit 304. Furthermore, the configuration estimating unit 305 manages system configuration attack path association information that associates the system configuration of the information processing device with attack paths as a product configuration database 310. If the identified attack route is included in the system configuration attack route mapping information, the system configuration corresponding to the attack route is estimated to be the system configuration of the information processing device, and the identified attack route is If it is not included in the configuration attack path mapping information, the analyst is prompted to register the system configuration corresponding to the attack path in the product configuration database 310 as system configuration attack path mapping information.

The configuration comparison unit 306 calculates the degree of similarity between the system configuration included in the system configuration attack path association information managed as the product configuration database 310 and the system configuration of the managed device.

The countermeasure presentation unit 307 manages countermeasure information that associates attack routes and countermeasures against attacks of the attack routes as a countermeasure database 312, and in the system configuration attack route mapping information managed as the product configuration database 310, management targets are A corresponding countermeasure is presented in the countermeasure information for an attack path corresponding to a system configuration having a predetermined degree of similarity to the system configuration of the device.

An incident information analysis method in the incident information analysis system configured as described above will be described below.

FIG. 3 is a sequence diagram showing the overall processing of the incident information analysis system shown in FIGS. 1 and 2. FIG. 4 is a flowchart for explaining an incident information analysis method in the incident information analysis system shown in FIGS. 1 and 2.

In the incident information analysis system shown in FIGS. 1 and 2, when the user 90 inputs text of incident information into the input device 11 in order to analyze incident information, the text of the input incident information is sent to the incident information analysis device 13. is inputted to the element identification section 303 via the input section 310 of. Then, the element identification unit 303 identifies the element from the input incident information (step 401).

FIG. 5 is a diagram showing an example of an incident information input screen displayed on the input device 11 shown in FIG. 1.

For example, as shown in FIG. 5, the incident information input screen displayed on the input device 11 shown in FIG. 1 includes an incident information input area D01 for inputting incident information, and an execution item for specifying execution items. It is conceivable that a designated area D02 and an execution button D03 for starting analysis of incident information are provided.

The user 90 specifies an execution item in the execution item specification area D02, inputs incident information in the incident information input area D01, and presses the execution button D03. Incident information may be entered into the incident information input area D01 by inputting the text of the incident information as is, or by specifying the URL of the incident information.

FIG. 6 is a flowchart for explaining element identification processing in the element identification unit 303 shown in FIG.

When incident information is input through the input unit 310, the element identification unit 303 first identifies the type of system from the input incident information (step 4011).

Next, the element identification unit 303 extracts words from the text of the incident information (step 4012).

Next, the element identification unit 303 refers to the security element database 308 and identifies the corresponding element for each extracted word (step 4013).

FIG. 7 is a diagram showing an example of the security element database 308 shown in FIG. 2.

As shown in FIG. 7, elements corresponding to words are registered in the security element database 308 shown in FIG. 2 for each type of system. Therefore, when words are extracted from the incident information, the element identification unit 303 can identify the corresponding element for each extracted word.

If there is no new word in the input incident information (step 4014), the element identification process in the element identification unit 303 ends.

On the other hand, if a new word exists in the input incident information, an element corresponding to the new word is registered in the security element database 308 (step 4015), and the process returns to step 4011.

When the element identification process in the element identification unit 303 is completed, the attack route identification unit 304 identifies the attack route (step 402).

FIG. 8 is a flowchart for explaining attack route identification processing in the attack route identification unit 304 shown in FIG.

In the attack route identification unit 304, when an element is identified by the element identification unit 303, the attack route definition database 309 is referred to, and a word corresponding to the element is extracted based on the combination of identified elements. The attack route followed by the attack indicated in the incident information is identified (step 4021).

FIG. 9 is a diagram showing an example of the attack path definition database 309 shown in FIG. 2. As shown in FIG.

As shown in FIG. 9, in the attack route definition database 309 shown in FIG. 2, elements such as types and details are registered in correspondence with each other depending on the type of system and can be identified by element identification numbers. , the attack route against the element identified by the element identification number is indicated by the element and its order, and is registered so as to be identifiable by the attack route identification number. Therefore, based on the combination of elements identified by the element identification unit 303, the attack route identification unit 304 identifies the attack route followed by the attack indicated in the incident information from which words corresponding to the elements have been extracted. be able to. At this time, as described above, since the attack route is indicated by a plurality of elements and their order, the attack route identification unit 304 may set the order of appearance of the elements in the incident information to the order of the elements in the attack route. can. In this way, by setting the order of appearance of elements in the sentence structure of incident information as the order in which the elements are traced along the attack route, the analyst can easily estimate the attack route.

Note that in this example, the attack route against the element identified by the element identification number is shown by the element and the order, but the attack order does not need to be shown.

When the attack route identification process in the attack route identification unit 304 is completed, the configuration estimation unit 305 then performs a process based on the elements identified by the element identification unit 303 and the attack route identified by the attack route identification unit 304. , configuration information regarding the system configuration of the information processing device is estimated (step 403).

FIG. 10 is a flowchart for explaining the configuration estimation process in the configuration estimation unit 305 shown in FIG. 4.

In the configuration estimation unit 305 , when the attack route is identified by the attack route identification unit 304 , the product configuration database 310 is referred to, and it is confirmed whether the identified attack route is registered in the product configuration database 310 . (Step 4031).

FIG. 11 is a diagram showing an example of the product configuration database 310 shown in FIG. 2. As shown in FIG.

As shown in FIG. 11, in the product configuration database 310 shown in FIG. 2, system configurations corresponding to attack routes are registered so as to be identifiable by product numbers. For the attack route, the attack route identification number shown in FIG. 9 is registered together with the combination of its elements. This information is not about our own products, but about the system configuration estimated from incident information collected from the Internet and SNS.

The configuration estimation unit 305 refers to the product configuration database 310 with such a configuration, and if the attack route identified by the attack route identification unit 304 is registered in the product configuration database 310, the identified attack route is A system configuration corresponding to is estimated (step 4032).

On the other hand, if the attack route identified by the attack route identification unit 304 is not registered in the product configuration database 310, the identified attack route and its system configuration are registered in the product configuration database 310 (step 4033).

In this way, the configuration estimating unit 305 manages system configuration attack route association information that associates the system configuration of the information processing device with the attack route as the product configuration database 310, and the identified attack route is the system configuration attack route. If it is included in the mapping information, the system configuration corresponding to that attack route is presumed to be the system configuration of the information processing device, and if the identified attack route is not included in the system configuration attack route mapping information. , the analyst is prompted to register the system configuration corresponding to the attack route in the product configuration database 310 as system configuration attack route correspondence information. Thereby, the system configuration of the information processing device targeted by the attack can be easily estimated based on the incident information. Furthermore, by prompting the analyst to add information that is not included in the system configuration attack path mapping information in the product configuration database 310, the system configuration attack path mapping information can be expanded.

In addition, the incident information analysis device 12 identifies elements based on the incident information, specifies the attack route based on the combination of the elements, and estimates the system configuration of the information processing device from the attack route. Incident information can be easily analyzed.

When the system configuration is estimated by the configuration estimation unit 305 in this manner, the estimated system configuration is output to the output device 12 via the output unit 302 and presented to the user 90 (step 404).

FIG. 12 is a diagram showing a configuration identification result output screen output from the configuration estimation unit 305 via the output unit 302.

As shown in FIG. 12, the configuration identification result output screen outputted from the configuration estimation unit 305 via the output unit 302 and displayed on the output device 12 includes the corresponding incident information D04 and the information corresponding to the incident information. The attack route and system configuration D05 are displayed, and a redo button D06 for redoing the analysis, a print button D07 for printing the results, and an end button D08 are provided.

In this way, the corresponding incident information and the attack route and system configuration corresponding to the incident information are outputted from the output unit 302 and displayed on the screen, so that the analyst can easily learn the analysis results. .

When the system configuration estimation process in the configuration estimation unit 305 is completed, the configuration comparison unit 306 compares the system configuration included in the system configuration attack route correspondence information managed as the product configuration database 310 and the system of the managed device. The degree of similarity with the configuration is calculated (step 405).

FIG. 13 is a flowchart for explaining the configuration comparison process in the configuration comparison unit 306 shown in FIG. 4.

In the configuration comparison unit 306, the system configuration registered in the product configuration database 310 is acquired via the configuration estimation unit 305 (step 4051), and when the system configuration of the company's product is acquired from the company's product database 311 ( Step 4052), first, it is checked whether these system configurations have been input (Step 4053).

FIG. 14 is a diagram showing an example of the company product database 311 shown in FIG. 2.

As shown in FIG. 14, the in-house product database 311 shown in FIG. The version, license, and number of connected or implemented components are registered so that they can be identified by numbers.

In the configuration comparison unit 306, if there is no input of either the system configuration registered in the product configuration database 310 or the system configuration of the company's product registered in the company product database 311, the user 90 via the input device 11 By inputting this, the system configuration of the company's product is acquired (step 4054).

FIG. 15 is a diagram showing an example of an in-house product configuration input screen when registering the system configuration of an in-house product in the in-house product database 311 shown in FIG. 2.

As shown in FIG. 15, when registering the system configuration of a company's product in the company's product database 311 shown in FIG. An area D09 and an influence determination execution button D10 that is pressed when performing influence determination are provided.

The user 90 inputs the system configuration of the company's product via the input device 11 using the company's product structure input screen shown in FIG.

The system configuration of the company's product input via the input device 11 is acquired by the configuration comparison unit 306 via the input unit 301 and registered in the company's product database 311 (step 4055), and the process returns to step 4052.

On the other hand, if either the system configuration registered in the product configuration database 310 or the system configuration of the company's product registered in the company's product database 311 is input, the configuration comparison unit 306 compares the system configurations with respect to these system configurations. Similarities are calculated in order from the layer closest to the interface to the layer farthest away (steps 4056A, 4057, 4058, 4056B).

Once the similarity is calculated for all the layers, the configuration comparison unit 306 calculates the similarity of the entire system based on the evaluation results for each layer (step 4059). Specifically, in the system configuration of information processing device A, layer x is xa, layer y is ya, and layer z is za. In the system configuration of information processing device B, layer x is xb, layer y is yb. , when layer z is zb, the similarity of the system configurations of information processing device A and information processing device B is (similarity (xa, xb)) x (similarity (ya, yb)) x (similarity degree (za, zb)). Note that the degree of similarity (xa, xa) may be determined in advance for each type of element. For example, in the case of physical component parts, the degree of similarity may be determined based on the degree of agreement between items such as standards, manufacturers, and versions.

In this way, when the system configuration is information having a hierarchical structure in which elements existing in each hierarchy are determined, the configuration comparison unit 306 synthesizes the similarities between the elements in each hierarchy in the system configuration and calculates the similarity. Since it is calculated and quantitatively evaluated, the analyst can easily obtain countermeasures for information processing devices having a predetermined degree of similarity.

When the configuration comparison process in the configuration comparison unit 306 is completed, the countermeasure presentation unit 307 calculates and presents countermeasures and effects for the incident (step 406).

FIG. 16 is a flowchart for explaining the countermeasure presentation process in the countermeasure presentation unit 307 shown in FIG.

The countermeasure presentation unit 307 first identifies products that are highly similar to the company's products (step 4061), and identifies countermeasures that are effective for the system configuration of similar products (step 4062).

Next, the countermeasure presentation unit 307 refers to the countermeasure database 312 and calculates the effectiveness of the specified countermeasure (step 4063).

FIG. 17 is a diagram showing an example of the countermeasure database 312 shown in FIG. 2.

As shown in FIG. 17, in the countermeasure database 312 shown in FIG. 2, attack routes, effective countermeasures for the attack routes, and their effects are registered in association with each other. Therefore, the countermeasure presentation unit 307 can calculate the effectiveness of the identified countermeasure. In this way, in the countermeasure database 312 shown in FIG. 2, in addition to attack routes and countermeasures, the effects of the countermeasures are associated as countermeasure information.

Thereafter, the countermeasure presentation unit 307 presents the calculated effect together with the specified countermeasure (step 4063). Specifically, the effect calculated by the countermeasure presentation section is displayed on the output device 12 by the output section 302 together with the specified countermeasure.

FIG. 18 is a diagram showing an impact determination result output screen output from the countermeasure presentation unit 307 via the output unit 302.

As shown in FIG. 18, the impact determination result output screen outputted from the countermeasure presentation unit 307 via the output unit 302 and displayed on the output device 12 includes an impact determination D11 indicating whether or not there is an impact on the company's products. , the degree of urgency D120 of the response, the degree of similarity D14 calculated by the configuration comparison unit 306, the system configuration, its recommended countermeasures, and the resulting effects D14, as well as the recalculation of countermeasures and effects. A redo button D15, a print button D16 for printing the results, and an end button D17 are provided.

In this way, countermeasures for the managed device selected based on the similarity of the system configuration are presented, so the analyst can easily estimate effective countermeasures against attacks on the managed device.

In addition, the countermeasure presentation unit 307 determines the effect of the countermeasure on the managed device based on the similarity calculated by the configuration comparison unit 306 and the effect corresponding to the countermeasure in the countermeasure information registered in the countermeasure database 312. By being calculated and presented together with the countermeasures, the analyst can know the expected effect when the presented countermeasures are applied to the information processing device that he or she manages. At this time, the presented countermeasure and the effect of the countermeasure on the management countermeasure device are displayed on the screen in association with each other by the output unit 302, so that the analyst can easily learn the countermeasure and its effect.

Incident information analysis device 13 in this embodiment is a computer having a CPU, memory, etc., and the CPU executes a software program using the memory.

The embodiments described above are illustrative examples of the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the invention in various other ways without departing from the scope of the invention.

DESCRIPTION OF SYMBOLS 10... Incident information analysis system, 11... Input device, 12... Output device, 13... Incident information analysis device, 90... User, 301... Input section, 302... Output section, 303... Element identification section, 304... Attack route identification section , 305...Configuration estimation section, 306...Configuration comparison section, 307...Countermeasure presentation section, 308...Security element database, 309...Attack route definition database, 310...Product configuration database, 311...In-house product database, 312...Countermeasure database

Claims (10)

an element identification unit that extracts a word from a sentence of incident information and identifies an element of the information processing device corresponding to the word;
an attack route identification unit that identifies an attack route followed by an attack indicated in the incident information based on a combination of the elements corresponding to the words extracted from the incident information;
An incident information analysis device comprising: a configuration estimation unit that estimates configuration information regarding a system configuration of the information processing device based on the identified element and the identified attack route. The attack path is indicated by a plurality of elements and their order,
The attack route identification unit sets the order of appearance of the elements in the incident information as the order of the elements in the attack route.
The incident information analysis device according to claim 1. The configuration estimating unit manages system configuration attack route association information that associates the system configuration of the information processing device with attack routes, and if the identified attack route is included in the system configuration attack route association information, , the system configuration corresponding to the attack route is estimated to be the system configuration of the information processing device, and if the identified attack route is not included in the system configuration attack route mapping information, the system configuration corresponding to the attack route is estimated to be the system configuration of the information processing device. prompting the analyst to register the configuration in the system configuration attack path mapping information;
The incident information analysis device according to claim 1. a configuration comparison unit that calculates the degree of similarity between the system configuration included in the system configuration attack route mapping information and the system configuration of the managed device;
Managing countermeasure information that associates attack routes with countermeasures against attacks of the attack routes, and in the system configuration attack route association information, corresponds to a system configuration that has a predetermined degree of similarity with the system configuration of the managed device. further comprising a countermeasure presentation unit that presents countermeasures corresponding to the countermeasure information of the attack route;
The incident information analysis device according to claim 3. The system configuration is information that has a hierarchical structure in which the elements that exist in each hierarchy are defined,
The configuration comparison unit calculates the similarity by combining similarities between elements of each hierarchy in the system configuration.
The incident information analysis device according to claim 4. In addition to the attack route and the countermeasure, the countermeasure information is associated with the effect of the countermeasure,
The countermeasure presentation unit calculates an effect of the countermeasure on the managed device based on the similarity and an effect corresponding to the countermeasure in the countermeasure information, and presents the countermeasure together with the countermeasure.
The incident information analysis device according to claim 4. further comprising an output unit that displays the incident information, the attack route and the system configuration corresponding to the incident information on a screen;
The incident information analysis device according to claim 1. further comprising an output unit that displays the proposed countermeasure and the effect of the countermeasure on the managed device in association with each other on a screen;
The incident information analysis device according to claim 6. Extracts the description of the information processing device elements included in the incident information,
identifying an attack route followed by an attack indicated in the incident information based on the combination of the elements extracted from the incident information;
estimating configuration information regarding a system configuration of the information processing device based on the extracted element and the identified attack route;
An incident information analysis method executed by a computer for analyzing incident information of the information processing device . Extracts the description of the information processing device elements included in the incident information,
identifying an attack route followed by an attack indicated in the incident information based on the combination of the elements extracted from the incident information;
estimating configuration information regarding a system configuration of the information processing device based on the extracted element and the identified attack route;
An incident information analysis program to be executed by a computer for analyzing incident information of the information processing device .

Images