WO2022219792A1

WO2022219792A1 - Collection device, collection method, and collection program

Info

Publication number: WO2022219792A1
Application number: PCT/JP2021/015645
Authority: WO
Inventors: 楊鐘本
Original assignee: 日本電信電話株式会社
Priority date: 2021-04-15
Filing date: 2021-04-15
Publication date: 2022-10-20

Abstract

A collection device (10) searches the Internet space for web site information by using a search engine with a keyword indicating the characteristic of a cyberattack serving as a search key, accesses each retrieved web site to collect information on a cyberattack, and presents a newly detected cyberattack from the collected information on a cyberattack.

Description

Collection device, collection method and collection program

The present invention relates to a collection device, collection method, and collection program for collecting information on cyberattacks.

While web applications are used in many services, they can be accessed by an unspecified number of people. Therefore, if a web application has a vulnerable system, it has the property of being easily exposed to attacks.

When attackers find vulnerabilities in web applications, they tend to search for vulnerable web applications in the Internet space in advance and attack them. Therefore, by detecting such search and attack activities as early as possible, it is possible to take early countermeasures, such as blocking attacks in advance.

Here, there are two main methods of collecting web attacks. For example, there is a technique of deploying honeypots and collecting information on attacks (see, for example, Non-Patent Document 1). Further, for example, there is a technique for detecting vulnerability scans by observing access logs for a Web server in normal operation and utilizing co-occurrence of accessed URLs (see, for example, Non-Patent Document 2).

However, with conventional technology, it is difficult to efficiently collect information about web attacks, and the challenge is to detect unknown attacks by attackers at an early stage. For example, the conventional technology depends on the scale of the attack observation environment, and since the size of the observation environment is limited, the latest trend of attacks cannot be collected efficiently. In addition, with conventional honeypot and web server observation technology, it is possible to recognize an attack when it reaches the observation environment. It is difficult to detect attacks early.

Therefore, the object of the present invention is to solve the problems described above, efficiently collect information on web attacks, and detect unknown attacks by attackers at an early stage.

In order to solve the above-mentioned problems, the collection device of the present invention includes an attack information search unit that searches for information on websites from the Internet space using a search engine using keywords that indicate the characteristics of cyber attacks as search keys; An attack information collection unit that accesses each searched website and collects information on the cyber attack, and a new attack presentation unit that presents the new cyber attack from the collected information on the cyber attack. characterized by

According to the present invention, it is possible to efficiently collect information on web attacks and present unknown attacks by attackers at an early stage.

FIG. 1 is a diagram showing a configuration example of a system including a collection device according to the first embodiment. FIG. 2 is a block diagram showing the configuration of the collection device of the first embodiment. FIG. 3 is a diagram showing an example of a seedlist stored in a seedlist database. FIG. 4 is a diagram showing an example of the target website search results stored in the collection target database. FIG. 5 is a diagram showing an example of search results stored in the collection target database for each seedlist keyword. FIG. 6 is a diagram showing an example of attack information stored in an attack information database. FIG. 7 is a diagram illustrating an example of the flow of processing by an attack information search unit; FIG. 8 is a diagram illustrating an example of the flow of processing by an attack information collection unit; FIG. 9 is a diagram illustrating an example of the flow of processing by an attack information collecting unit that acquires attack information from different access log formats. FIG. 10 is a diagram illustrating an example of the flow of processing in which the new attack presentation unit updates the seed list. FIG. 11 is a flow chart showing an example of the processing procedure of the collection device 10. As shown in FIG. FIG. 12 is a diagram showing an example of the processing flow of the collection device 10. As shown in FIG. FIG. 13 is a diagram showing a configuration example of a computer that executes the collection program.

A first embodiment, which is a form (embodiment) for carrying out the present invention, will be described below with reference to the drawings. The invention is not limited to the embodiments.

[First Embodiment]
First, a configuration example of a system including the collection device 10 of the first embodiment will be described with reference to FIG. The collection system includes, for example, a website 2a on a server, a search engine 2b on the server, a terminal 3, and a collection device 10, which are connected via a network 1. FIG.

A network 1 is a computer network that can connect multiple computers and electronic devices to exchange signals, data, and information. Also, the network 1 may be either a wired connection or a wireless connection. The website 2a indicates a group of web pages stored on the server.

The search engine 2b refers to a system that allows users to search for data and files that exist in a general system by entering keywords and conditions. Examples of the search engine 2b include "Chrome" (registered trademark) provided by Google and "Bing" (registered trademark) provided by Microsoft.

The terminal 3 is an electronic device terminal operated by an operator or a cyberattack information monitor. For example, the terminal 3 is a desktop PC (Personal Computer), a notebook PC, a tablet terminal, a mobile phone, a PDA (Personal Digital Assistant), or the like.

The collection device 10 searches for information on websites 2a from the Internet space using a search engine 2b using keywords that indicate the characteristics of cyberattacks as search keys, accesses each of the websites 2a that have been searched, and collects information related to cyberattacks. It collects information and presents novel cyberattacks from the collected information about cyberattacks.

As a result, the collection device 10 can efficiently collect information about web attacks from the Internet space using the search engine 2b and the like, and can present unknown attacks by attackers at an early stage.

Next, a configuration example of the collection device 10 will be described using FIG. As shown in the figure, the collection device 10 has a communication section 11 , a control section 12 and a storage section 13 . Processing of each unit of the collection device 10 will be described below.

The communication unit 11 controls communication related to various information including cyber attacks. For example, the communication unit 11 controls communications related to various types of information exchanged with the collection device 10, the website 2a, the search engine 2b, and the terminal 3, which are connected via the network 1. FIG. For example, the communication unit 11 transmits various information about cyberattacks to the terminal 3 .

The storage unit 13 stores data and programs necessary for various processes by the control unit 12. The storage unit 13 also has a seed list database 13a (seed list DB in the illustration), a collection target database 13b (collection target DB in the illustration), and an attack information database 13c (attack information DB in the illustration). For example, the storage unit 13 is a semiconductor memory device such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk.

Next, the seed list database 13a of the storage unit 13 will be explained. The seed list database 13a stores a seed list in which keywords indicating characteristics of cyberattacks are stored in advance.

A seed list is information that indicates the characteristics of a cyberattack, and indicates the seed list keywords stored on the list. Here, the seedlist keyword refers to, for example, a keyword of a search key used by an attacker to investigate web applications having vulnerabilities in advance. For example, seed list keywords include "/.env" used for searching OS information and "/HNAP1" used for searching router information.

FIG. 3 is a diagram showing an example of a seedlist stored in the seedlist database 13a. For example, as shown in FIG. 3, the seedlist database 13a stores "/phpMyAdmin" used as part of the URL of the management system of the website 2a as a seedlist keyword in the seedlist database 13a.

For example, the seed list database 13a stores preset seed lists. Further, the seed list database 13a may overwrite a preset seed list with a new seed list keyword presented by the new attack presentation unit 12c, which will be described later, and store the new seed list keyword.

Next, the collection target database 13b of the storage unit 13 will be described. The collection target database 13b stores website information periodically acquired by the attack information search unit 12a, which will be described later.

The collection target database 13b associates and stores seed list keywords, search content, and target websites. For example, the collection target database 13b stores the seedlist keyword information acquired from the seedlist database 13a in the item "seedlist keyword" (hereinafter referred to as the seedlist keyword item). In addition, the collection target database 13b stores search keyword information input to the search engine 2b by the attack information search unit 12a, which will be described later, in the "search content" item (hereinafter referred to as search content item). In addition, the collection target database 13b stores the URL information of the website 2a that can be the attack target in the item of "target website" (hereinafter referred to as the target website item).

FIG. 4 is a diagram showing an example of the target website search results stored in the collection target database 13b. For example, as shown in FIG. 4, the collection target database 13b stores "/phpMyAdmin" in the seed list keyword item. In addition, the collection target database 13b stores the search keyword "GET/phpMyAdmin HTTP/1.1" in the search content item. In addition, the collection target database 13b stores, in the target website item, "aaa.com/access_log/2021-01-01", which is the URL information of the website 2a that can be attacked.

FIG. 5 is a diagram showing an example of search results stored in the collection target database 13b for each seed list keyword. For example, as shown in FIG. 5, the collection target database 13b may store search results for each seed list keyword.

For example, as shown in FIG. 5, the collection target database 13b stores "/HNAP1" in the seed list keyword item, stores the search keyword "GET/HNAP1 HTTP/1.1" in the search content item, and As a search result for the keyword "/HNAP1", "bbb.com/access_log/2021-01-01", which is the URL information of the website 2a that can be attacked, is stored in the target website item.

For example, as shown in FIG. 5, the collection target database 13b stores "/.env" in the seed list keyword item, stores the search keyword "GET/.env HTTP/1.1" in the search content item, As a search result of the seed list keyword "/.env", "ccc.com/access_log/2021-01-01", which is the URL information of the website 2a that can be attacked, is stored in the target website item.

Next, the attack information database 13c of the storage unit 13 will be explained. The attack information database 13c stores cyber attack information on website information acquired by the attack information collecting unit 12b, which will be described later.

FIG. 6 is a diagram showing an example of attack information stored in the attack information database 13c. For example, the attack information database 13c stores the method information "GET" in the method item of the attack information. Also, the attack information database 13c stores the search keyword "/phpMyAdmin" in the search keyword item of the attack information.

In addition, the attack information database 13c stores "aaa.com/access_log/2021-01-01", which is the URL information of the website 2a that suffered a cyber attack, in the URL item. In addition, the attack information database 13c stores "2021-01-01", which is the attack time indicating the time when the cyber attack information was received, in the attack time item.

The attack information database 13c stores the method information used in the HTTP request, the URL information of the attack target website 2a, and the attack time indicating the time when the cyber attack information was received.

Next, the control unit 12 will be explained. The control unit 12 controls the collection device 10 as a whole. The control unit 12 includes an attack information search unit 12a, an attack information collection unit 12b, and a new attack presentation unit 12c. The control unit 12 has an internal memory for storing programs defining various processing procedures and required data, and executes various processing using these.

For example, the control unit 12 has an attack information search unit 12a, an attack information collection unit 12b, and a new attack presentation unit 12c. Here, the control unit 12 is an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

First, the attack information search unit 12a of the control unit 12 will be described. The attack information search unit 12a searches for information on the website 2a from the Internet space using the search engine 2b using keywords that indicate the characteristics of cyberattacks as search keys.

For example, the attack information search unit 12a creates a search keyword for each keyword of the seed list based on a seed list in which keywords indicating characteristics of cyber attacks are stored in advance, and activates the search engine 2b for each created search keyword. to search for information on the website 2a. The attack information search unit 12a also stores the collected URL information and search keywords of the website 2a in the collection target database 13b.

FIG. 7 is a diagram showing an example of the processing flow of the attack information search unit 12a. For example, the attack information search unit 12a acquires one seedlist keyword from the seedlist database 13a.

Then, the attack information search unit 12a combines pre-stored keywords to create a plurality of search keywords for one seed list keyword. For example, the attack information search unit 12a creates a search keyword by adding "GET" and "HTTP/1.1", which are method information, before and after the acquired seed list keyword.

A search keyword is a keyword used by the attack information search unit 12a when inputting to the search engine 2b and performing a search. Examples of preset combinations of keywords used when creating search keywords include "GET", "POST", "HTTP/1.0", and "HTTP/2". At this time, the ratio of the total number of seed list keywords and search keywords is 1:N.

Then, the attack information search unit 12a periodically searches the corresponding website 2a with the search engine 2b for each created search keyword. The attack information search unit 12a stores URL information of the website 2a for each search keyword. At this time, the ratio of the search keyword to the total number of Web sites 2a searched is 1:N. Moreover, the total ratio of the seed list keyword, the search keyword, and the searched Web sites 2a has a relationship of 1:N:N^2.

Subsequently, the attack information search unit 12a stores the seedlist keyword information acquired from the seedlist database 13a as the seedlist keyword item, stores the created search keyword information as the search content item, As a site item, the URL information of the website 2a is stored in the collection target database 13b. That is, the attack information search unit 12a associates and stores the seed list keyword, the search content, and the target website.

For example, as shown in FIG. 7, the attack information search unit 12a acquires "/phpMyAdmin", "/.env", and "/HNAP1" as a plurality of seedlist keywords from the seedlist database 13a. Next, the attack information search unit 12a creates "GET /phpMyAdmin HTTP /1.1" as a search keyword for the seed list keyword "/phpMyAdmin". The attack information search unit 12a uses the search keyword "GET/phpMyAdminHTTP/1.1" to search for the website 2a that can be targeted for a web attack from the public access logs existing in the Internet space.

Then, the attack information search unit 12a stores the website 2a hit from the search result of the search keyword "GET/phpMyAdminHTTP/1.1" as the target website in the collection target database 13b. For example, the attack information search unit 12a retrieves URL information of the website 2a such as "aaa.com/access_log/2021-01-01", "bbb.com/blog/bbb.html", "ccc.com/stats/ html” and “ddd.com/” are stored in the target website item, and stored in association with the search keyword “GET /phpMyAdmin HTTP /1.1”.

Also, for example, when the attack information search unit 12a creates the search keyword "POST /phpMyAdmin HTTP/1.0" using the seed list keyword "/phpMyAdmin", the attack information search unit 12a uses the search keyword "POST /phpMyAdmin HTTP/1.0" is used to search for a Web site 2a that can be targeted for a Web attack from public access logs existing in the Internet space.

Then, the attack information search unit 12a stores the website 2a hit from the search result of the search keyword "POST/phpMyAdminHTTP/1.0" in the collection target database 13b as the target website. For example, the collection target database 13b stores "eee.com/access_log/2021-01-01" and "ggg.com/blog/bbb.html", which are the URL information of the website 2a, as items of the target website. Store in association with the search keyword "POST /phpMyAdmin HTTP/1.0".

Also, for example, when the attack information search unit 12a creates the search keyword "GET /phpMyAdmin HTTP/2" using the seed list keyword "/phpMyAdmin", the attack information search unit 12a uses the search keyword "GET /phpMyAdmin HTTP/2” is used to search for a Web site 2a that can be targeted for a Web attack from public access logs existing in the Internet space.

The attack information search unit 12a stores the website 2a hit from the search result of the search keyword "GET/phpMyAdminHTTP/2" as the target website in the collection target database 13b. For example, the collection target database 13b uses the URL information "hhh.com/stats/index.html" and "kkk.com/" of the website 2a as items of the target website, and the search keyword "GET /phpMyAdmin HTTP /2" and store it.

Next, the attack information collection unit 12b of the control unit 12 will be explained. The attack information collection unit 12b accesses each collected website 2a and collects information on cyber attacks.

For example, the attack information collection unit 12b accesses the website 2a, collects information about cyberattacks from the access log of the website 2a, determines whether or not there is an attack based on the status code written in the access log, In response, information on the attack time and search keyword indicating the date and time of the attack is collected from the attack information.

Further, for example, the attack information collecting unit 12b periodically collects attack time and search keyword information from the attack information, and collects the latest access log information until the attack time is updated to the latest date and time. Each piece of attack information is shaped into a predetermined format and stored in the attack information database 13c that collects attack information.

FIG. 8 is a diagram showing an example of the processing flow of the attack information collection unit 12b. As shown in FIG. 8, the attack information collection unit 12b accesses the target website "aaa.com/access_log/2021-01-01" and acquires attack information from the access log. The access log information posted includes normal access that is not intended as an attack. For this reason, the attack information collecting unit 12b determines an attack when the status code written in the access log is in the 400s, for example.

The method of determining whether or not there is an attack is set in advance, and it is possible to change the conditions later. The attack information collection unit 12b collects access log information determined as an attack and stores it in the attack information database 13c.

For example, when the URL of the website 2a includes a date such as "2021-01-01" or "2021/01/01", the attack information collection unit 12b formats the information in the date part, Collect access log information until the date of

For example, the attack information collection unit 12b stores "GET", which is the method information, in the method item of the attack information in the attack information database 13c. Also, the attack information collection unit 12b stores the search keyword "/phpMyAdmin" in the attack information search keyword item of the attack information database 13c.

In addition, the attack information collection unit 12b stores "aaa.com/access_log/2021-01-01", which is the URL information of the website 2a that was subjected to the cyber attack, in the URL item of the attack information database 13c. In addition, the attack information collection unit 12b stores "2021-01-01", which is the attack time indicating the time of the cyber attack, in the attack time item of the attack information database 13c.

In addition, the content posted on the web page may be written in the form of a log, or may be posted in a format such as a formatted table or list. FIG. 9 is a diagram showing an example of the processing flow of the attack information collection unit 12b that acquires attack information from different access log formats.

As shown in FIG. 9, the attack information collection unit 12b extracts and acquires the portion corresponding to the attack information from the values in the table or list format. For example, the attack information collection unit 12b stores "GET", which is method information, in the method item of the attack information in the attack information database 13c. Also, the attack information collection unit 12b stores the search keyword "/CFIDE/administrator/" in the attack information search keyword item of the attack information database 13c.

In addition, the attack information collection unit 12b stores "bbb.com/blog/bbb.html", which is the URL information of the website 2a that has suffered a cyber attack, in the URL item of the attack information database 13c. In addition, the attack information collection unit 12b stores "2021-01-01", which is the attack time indicating the time of the cyber attack, in the attack time item of the attack information database 13c.

In this way, the attack information collection unit 12b can extract and acquire portions corresponding to attack information from different access log formats.

Next, the new attack presentation unit 12c of the control unit 12 will be explained. The new attack presentation unit 12c presents a new cyber attack from the collected information on cyber attacks.

For example, the novel attack presentation unit 12c presents to the user a newly discovered cyber attack from the collected attack information, and when detecting information related to a new search keyword, determines that it is an unknown attack, and adds a new attack to the seed list. Update search keyword information.

FIG. 10 is a diagram showing an example of the flow of processing for updating the seed list by the new attack presentation unit 12c. For example, as shown in FIG. 10, the new attack presenting unit 12c compares collected attack information with existing attack information to detect a newly discovered attack "/CFIDE/administrator/". When detecting a newly discovered attack, the new attack presenting unit 12c updates the information as "unknown attack" in the corresponding item of the attack information database 13c.

For example, as shown in FIG. 10, the new attack presenting unit 12c adds a value of "YES" to the item "unknown attack" in the line "/CFIDE/administrator/", which is a newly discovered attack.

Then, the new attack presentation unit 12c presents attack information to the terminal 3 of the operator or the monitor, regarding the newly discovered attack "/CFIDE/administrator/" as an unknown attack. Further, the new attack presenting unit 12c recognizes the newly discovered attack "/CFIDE/administrator/" as a seed list keyword, and updates the seed list database 13a.

In this way, the collection device 10 uses the search engine 2b to search for information on the website 2a from the Internet space using keywords that indicate the characteristics of cyberattacks as search keys, and accesses each searched website 2a. , collects information about cyberattacks and presents new cyberattacks from the collected information about cyberattacks.

In addition, the collection device 10 can effectively collect websites 2a that can be targets of cyberattacks by creating various search keywords using preset seedlist keywords. Furthermore, by updating the seedlist, the collection device 10 can always collect the latest access log information and acquire general-purpose attack information and the seedlist. In addition, the collection device 10 can collect attack information using the search engine 2b on the Internet space without depending on observation environments such as honeypots and web servers.

In other words, the collection device 10 detects in advance the websites 2a that can be targets of cyberattacks and limits the websites 2a to be monitored, thereby detecting unknown attacks by attackers at an early stage. It is effective in that it can contribute to grasping the attack trend of

[Example of collection device processing]
Next, the processing of the collection device 10 will be described with reference to FIG. 11 . FIG. 11 is a flow chart showing an example of the processing procedure of the collection device 10. As shown in FIG.

As shown in FIG. 11, the attack information search unit 12a of the collection device 10 acquires information on the website 2a that publishes attack information using the search engine 2b based on the seed list (S1).

For example, the attack information search unit 12a acquires one seedlist keyword from the seedlist database 13a. Then, the collection device 10 combines pre-stored keywords to create a plurality of search keywords for one seed list keyword. Then, the attack information search unit 12a searches the Web site 2a corresponding to each created search keyword using the search engine 2b.

Then, the attack information collection unit 12b acquires attack information of the website 2a based on the URL information of the website 2a collected in S1 (S2).

For example, the attack information collection unit 12b collects information about cyberattacks from access logs published in the Internet space, determines the presence or absence of an attack based on the status code written in the access log, and, depending on the determination result, collects attack information. Collect attack time and search keyword information that indicates the date and time of the attack.

Subsequently, the new attack presentation unit 12c outputs the attack information acquired in S2 to the terminal 3, and updates the seed list database 13a with new search keywords (S3). The collection device 10 repeats a series of processes from S1 to S3 to acquire the latest attack information. In other words, after the seed list database 13a is updated, the collecting device 10 repeats the process of searching for the new website 2a using the new search keyword and acquiring the latest attack information.

FIG. 12 is a diagram showing an example of the processing flow of the collection device 10. FIG. For example, as shown in FIG. 12, the collection device 10 uses the seed list database 13a to search the website 2a from the search engine 2b using the keyword of the vulnerable web application as the search key.

Then, the collection device 10 acquires the access log of the website 2a that may be the target of a cyber attack, and accumulates the attack information in the database owned by the collection device 10. Subsequently, the collection device 10 periodically monitors the target website 2a using the accumulated attack information, and presents it to the monitor's terminal 3 when new attack information is detected.

[Effect of Embodiment 1]
The collection device 10 searches for information on websites 2a from the Internet space using a search engine 2b using keywords that indicate the characteristics of cyberattacks as search keys, accesses each of the websites 2a that have been searched, and collects information related to cyberattacks. It collects information and presents novel cyberattacks from the collected information about cyberattacks.

In addition, the collection device 10 creates a search keyword for each keyword of the seed list based on a seed list in which keywords indicating characteristics of cyberattacks are stored in advance, and uses the search engine 2b for each created search keyword. Information on the website 2a can be searched.

As a result, the collection device 10 can create various search keywords using preset seed list keywords, and effectively collect websites 2a that can be targets of cyberattacks.

In addition, the collection device 10 accesses the website 2a, collects information on cyberattacks from the access log of the website 2a, determines the presence or absence of an attack based on the status code written in the access log, , attack time indicating the date and time of attack and information on search keywords can be collected from the attack information.

As a result, the collection device 10 can collect detailed attack information including the attack time from different access log formats using the status code written in the access log.

In addition, the collection device 10 periodically collects attack time and search keyword information from attack information, collects the latest access log information until the attack time is updated to the latest date, and collects each collected attack information. It can be shaped into a predetermined format and stored in the attack information database 13c that collects attack information.

As a result, the collection device 10 can routinely collect the latest access log information and acquire general-purpose attack information and seed lists.

In addition, the collection device 10 presents a newly discovered cyber attack from the collected attack information to the user, and when a new search keyword is detected, determines that it is an unknown attack, and adds the information of the new search keyword to the seed list. can be updated.

As a result, the collection device 10 presents unknown attacks by attackers to the monitor at an early stage, so that the monitor can grasp the latest attack trends.

[System configuration, etc.]
Also, each constituent element of each part shown in the figure is functionally conceptual, and does not necessarily need to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to the illustrated one, and all or part of them can be functionally or physically distributed and integrated in arbitrary units according to various loads and usage conditions. Can be integrated and configured. Furthermore, all or any part of each processing function performed by each device can be implemented by a CPU and a program executed by the CPU, or implemented as hardware based on wired logic.

Further, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed manually. All or part of this can also be done automatically by known methods. In addition, information including processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
The collecting device 10 described above can be implemented by installing a program as package software or online software on a desired computer. For example, by causing the information processing device to execute the above program, the information processing device can function as the collection device 10 of each embodiment. The information processing apparatus referred to here includes a desktop or notebook personal computer. In addition, information processing devices include mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone Systems), and terminals such as PDAs (Personal Digital Assistants).

The collection device 10 can also be implemented as a server device that uses a terminal device used by a user as a client and provides the client with services related to the above processing. In this case, the server device may be implemented as a web server, or may be implemented as a cloud that provides services related to the above processing by outsourcing.

FIG. 13 is a diagram showing an example of a computer that executes a collection program. The computer 1000 has a memory 1010 and a CPU 1020, for example. Computer 1000 also has hard disk drive interface 1030 , disk drive interface 1040 , serial port interface 1050 , video adapter 1060 and network interface 1070 . These units are connected by a bus 1080 .

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012 . The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090 . A disk drive interface 1040 is connected to the disk drive 1100 . A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100 . Serial port interface 1050 is connected to mouse 1110 and keyboard 1120, for example. Video adapter 1060 is connected to display 1130, for example.

The hard disk drive 1090 stores, for example, an OS 1091, application programs 1092, program modules 1093, and program data 1094. That is, the program that defines each process executed by the collection device 10 is implemented as a program module 1093 in which computer-executable code is described. Program modules 1093 are stored, for example, on hard disk drive 1090 . For example, the hard disk drive 1090 stores a program module 1093 for executing processing similar to the functional configuration of the collection device 10 . Note that the hard disk drive 1090 may be replaced by an SSD.

Also, each data used in the processing of the above-described embodiments is stored as program data 1094 in the memory 1010 or the hard disk drive 1090, for example. Then, the CPU 1020 reads out the program modules 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary and executes them.

The program modules 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, program modules 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Program modules 1093 and program data 1094 may then be read by CPU 1020 through network interface 1070 from other computers.

1 Network 2a Web site (server)
2b Search engine (server)
3 Terminal 10 Collection device 11 Communication unit 12 Control unit 12a Attack information search unit 12b Attack information collection unit 12c New attack presentation unit 13 Storage unit 13a Seed list database 13b Collection target database 13c Attack information database

Claims

an attack information search unit that searches for website information from the Internet space using a search engine using keywords that indicate the characteristics of cyberattacks as search keys;
an attack information collection unit that accesses each searched website and collects information about the cyber attack;
a new attack presentation unit that presents a new cyber attack from the collected information on the cyber attack;
A collection device comprising:
The attack information search unit,
creating a search keyword for each keyword in the seed list based on a seed list in which keywords indicating characteristics of the cyber attack are stored in advance;
2. The collecting device according to claim 1, wherein the information on the website is searched using a search engine for each of the created search keywords.
The attack information collection unit,
Accessing the website, collecting information on the cyber attack from the access log of the website,
A claim characterized in that the presence or absence of an attack is determined based on the status code written in the access log, and based on the result of the determination, the time of attack indicating the date and time of the attack and information on search keywords are collected from the information on the cyberattack. Item 1. The collection device according to item 1.
The attack information collection unit,
Periodically collect information on the attack time and search keywords indicating the date and time of the attack from the information on the cyber attack,
collecting the latest access log information until the attack time is updated to the latest date and time;
Formatting the collected information on the cyber attack into a predetermined format,
2. The collecting device according to claim 1, wherein the attack information is stored in an attack information database that collects the attack information.
The new attack presentation unit,
Presenting the new cyber attack to the user from the collected information on the cyber attack;
When information related to new search keywords is detected, it is determined as an unknown attack,
2. The collection device according to claim 1, wherein the information of the new search keyword is updated in a seed list in which keywords indicating characteristics of the cyberattack are stored in advance.
A collection method performed by a collection device, comprising:
a step of searching website information from the Internet space using a search engine using a keyword that indicates the characteristics of a cyberattack as a search key;
accessing each searched website and collecting information about the cyberattack;
presenting the newly discovered cyber attack from the collected information on the cyber attack;
A collection method characterized by comprising
a step of searching website information from the Internet space using a search engine using a keyword that indicates the characteristics of a cyberattack as a search key;
accessing each searched website and collecting information about the cyberattack;
presenting the newly discovered cyber attack from the collected information on the cyber attack;
A collection program characterized by causing a computer to execute