JP2008167099A - Device and method for managing security, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To generate the generating scenario of a security incident when the security incident is generated. <P>SOLUTION: In a security incident specifier 111, tag information is extracted from security information or the like collected by a security-information collector 12, a plurality pieces of the security information are stored as incident meta information together with the tag information and a scenario element as the element of the generating scenario is contained in the incident meta information. When feature-parameter information indicating the feature parameter of a detected malfeasant access is received from an intrusion detector 110, the incident meta information containing the tag information coinciding with the feature parameter is extracted and the generating scenario of the malfeasant access is generated by using the scenario element of the detected incident meta information. A scenario score to the generated generating scenario is set, and the generated generating scenario and the scenario score of the generating scenario are displayed. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a technique for specifying a security incident occurrence scenario when a security incident including unauthorized access occurs.

In recent years, with the spread of the Internet, various services have been provided through networks.
For example, services are also provided in familiar places such as online banking in which transactions are made with a bank via the Internet, and Internet shopping that allows shopping from a home PC (Personal Computer) or a mobile terminal.
As described above, while the importance of the Internet and information technology as social infrastructure has increased, unauthorized access via the network has been increasing and has become a serious problem.

One of countermeasures against such unauthorized access via a network is intrusion detection technology.
The intrusion detection technology is a technology for detecting when an unauthorized access occurs on a monitoring target.
Intrusion detection technology is classified into a fraud detection method and an anomaly detection method based on the difference in detection method.
In the fraud detection method, a pattern (signature) for detecting unauthorized access is defined from the characteristics of each unauthorized access, and when data or a log that matches the defined signature occurs, it is detected as the occurrence of unauthorized access.
On the other hand, in the anomaly detection method, when an unauthorized access occurs, the normal state of the monitored system is defined based on the idea that some abnormalities are observed on the monitored system, The occurrence of unauthorized access is detected by detecting the difference between the defined normal state and the observed state.

Currently, intrusion detection devices that are widely used are based on fraud detection methods.
In the unauthorized detection method, unauthorized access can be detected by simple pattern matching between the detection signature and the observation data, so high-speed processing is possible, and if the unauthorized access features can be correctly defined as signatures, detection accuracy is high. There is an advantage.
However, whether or not unauthorized access can be detected depends on whether or not a signature for detection is defined and set in the intrusion detection device. Therefore, intrusion detection devices such as newly generated attacks and worm variants can be used. There is a problem that an attack with a characteristic that is partially different from the set signature cannot be detected.
Here, the worm variant refers to a virus that is created by modifying a part of the worm that is already on the market. The basic operation is the same as that of the original worm, but it cannot be detected by the signature for detecting the original worm due to some changes. A new signature is needed.

  On the other hand, in the anomaly detection method, since unauthorized access is detected by detecting an anomaly that occurs in the system due to unauthorized access, it is possible to detect unauthorized access regardless of the signature that extracted the characteristics of each unauthorized access. In recent years, it has been attracting attention because it is possible to detect an early attack even for a newly generated attack.

As an unauthorized access detection and countermeasure technique using an intrusion detection apparatus based on an abnormality detection method, for example, there is a technique disclosed in Patent Document 1 as shown in FIG.
In the prior art 1, a kind of decoy system called a passive host sensor 11 is used as an intrusion detection device based on an abnormality detection method.
A decoy system is a method of unauthorized access by installing a device that appears to be vulnerable (or that is actually vulnerable) on the network and observing access to the device. This is a system for refinement.
Since it is not disclosed, it is considered that access to the terminal of the decoy system does not normally occur. Accordingly, it is presumed that all accesses to the decoy system terminal are performed with malicious intent, and therefore unauthorized access is detected by detecting access (= abnormal) to the decoy system terminal.
In the technique of Patent Document 1, as a countermeasure after detecting unauthorized access, a signature for detecting unauthorized access is automatically generated based on the observation result of the passive host sensor 11, and subsequent attacks are based on the unauthorized detection method. It can be detected by an intrusion detection device.
Japanese Patent Laid-Open No. 2005-31679

  However, in general, the intrusion detection apparatus based on the abnormality detection method including the technique of Patent Document 1 captures the abnormality detected on the monitoring target as a group of unauthorized access. In order to identify the details of detected unauthorized access, such as whether access is by a variant of a known worm or access by a new worm, the recorded logs and security-related There is a problem that it takes time to identify the details of unauthorized access.

  One of the main objects of the present invention is to solve the above-mentioned problems. For example, in the intrusion detection based on the anomaly detection method, when an anomaly related to unauthorized access is detected, The main purpose is to identify whether access is detected.

The security management device according to the present invention is:
A security management device connected to a detection device that detects the occurrence of a security incident in a monitoring target,
An incident meta information database for storing a plurality of incident meta information indicating scenario elements which are elements of a security incident occurrence scenario and security attributes related to the scenario elements;
A detection security incident information receiving unit for receiving detection security incident information indicating a security attribute of a detection security incident detected by the detection device from the detection device;
An incident meta information extracting unit that extracts incident meta information indicating a security attribute that matches the security attribute of the detected security incident indicated in the detected security incident information within a predetermined range;
An occurrence scenario generation unit that generates an occurrence scenario of a detected security incident using a scenario element indicated in the incident meta information extracted by the incident meta information extraction unit.

  According to the present invention, incident meta information indicating scenario elements corresponding to security attributes is accumulated, and when a security incident is detected, a scenario element of a security attribute that matches the security attribute of the detected security incident is extracted. Therefore, an occurrence scenario of a detected security incident is generated using the extracted scenario elements, so that an appropriate occurrence scenario corresponding to the security attribute of the detected security incident can be generated. Since the details of the security incident can be specified, it is possible to take the best countermeasure against the security incident at an early stage.

Embodiment 1 FIG.
An event that is generally regarded as a security problem that occurs on the monitored network, including unauthorized access, is called a security incident. Examples of security incidents include unauthorized access, traffic anomalies, springboards, SPAM mail, service denials, data destruction, unintentional information disclosure, and actions (events) to reach them. .
Security incidents are refined as a series of occurrence scenarios composed of various information elements to explain when, where, who, why, what, and how.
Therefore, in this embodiment, for example, in an intrusion detection based on an anomaly detection method, when an anomaly due to the occurrence of some security incident is detected, an occurrence scenario for a security incident that is likely to occur is usually By generating based on the security-related information collected, the contents of the security incident that occurred are identified and detailed.
Hereinafter, the occurrence scenario is also referred to as an incident scenario, a combined scenario, or simply a scenario.

FIG. 1 is a system configuration diagram showing a system configuration example according to the present embodiment.
In FIG. 1, reference numeral 100 denotes the Internet, 101 denotes a monitoring target network, 110 denotes an intrusion detection device (detection device), 111 denotes a security incident identification device (security management device), and 112 denotes a security information collection device.
The intrusion detection device 110 in the present embodiment will be described assuming that it detects unauthorized access based on an abnormality detection method unless otherwise specified.
This is because the present embodiment focuses on the details of the contents of unauthorized access detected by the intrusion detection device based on the abnormality detection method.
However, the intrusion detection device 110 may detect unauthorized access based on an unauthorized detection method.

In FIG. 1, the intrusion detection device 110 detects the occurrence of a security incident based on various data observed on the monitored network 101. Hereinafter, a case where an unauthorized access is detected as a security incident will be described as an example.
The data to be analyzed by the intrusion detection device 110 depends on the implementation of the intrusion detection device introduced into the system. In this specification, the data analyzed by the intrusion detection device 110 is not particularly limited. , Data relating to network traffic, data set on the monitored network 101, data (security log) recorded by a security monitoring device such as a firewall, intrusion detection device (regardless of detection method), and connected to the monitored network 101 Data collected from inside each terminal.

  The security information collection device 112 collects information related to security from information sites on the Internet 100 sequentially or periodically.

When the intrusion detection device 110 that monitors the monitored network 101 detects the occurrence of unauthorized access on the monitored network 101, the security incident identification device 111 identifies the security incident that occurred based on the incident meta information. Identify the outbreak scenario.
Here, the incident meta information includes various information that is a constituent element of the scenario of the occurrence of the security incident including information unique to the monitored network such as maintenance information in addition to the information collected by the security information collecting apparatus 112. Pointing.
The incident meta information includes a scenario element that is an element of a security incident occurrence scenario and tag information that indicates a security attribute related to the scenario element.
Although details will be described later, for example, each of the worm information 411, vulnerability information 412, and security situation information 413 illustrated in FIG. 4 is incident meta information.
Of the worm information 411, information shown in the “worm name” column is a scenario element. Similarly, in the vulnerability information 412, the information shown in the “vulnerability ID” column is a scenario element, and in the security situation information 413, the information shown in the “content” column is a scenario element. The security incident identification device 111 combines these scenario elements to generate a security incident occurrence scenario.
In addition, a portion surrounded by a rectangle denoted by reference numeral 421 in the worm information 411 is tag information, which indicates the security attribute of the worm indicated by “worm name”.
Similarly, in the vulnerability information 412, a portion surrounded by a rectangle indicated by 422 is tag information, and in the security situation information 413, a portion surrounded by a rectangle indicated by 423 is tag information.
The incident meta information may be abbreviated as meta information for short.

Here, an example of the operation of the security incident identification device 111 according to the present embodiment will be outlined.
The security incident identification device 111 extracts tag information from the security information collected by the security information collection device 112, and stores and stores a plurality of security information as incident meta information together with the tag information.
When the feature parameter information (detected security incident information) indicating the feature parameter (security attribute) of unauthorized access (detected security incident) detected by the intrusion detecting device 110 is received from the intrusion detecting device 110, the security incident identifying device 111 Extracts incident meta information including tag information (security attribute) that matches the characteristic parameter of unauthorized access indicated in the characteristic parameter information within a predetermined range.
Then, the security incident identification device 111 generates an unauthorized access occurrence scenario detected using the scenario element indicated in the extracted incident meta information.
Specifically, the security incident identification device 111 normally extracts two or more incident meta information, and combines the scenario elements that are correlated among the scenario elements indicated in the extracted two or more incident meta information. Generate an outbreak scenario.
Also, the security incident identification device 111 sets a scenario score (evaluation value) for the generated occurrence scenario, and displays the generated occurrence scenario and the scenario score of the occurrence scenario.

Next, a configuration example inside the security incident identification device 111 will be described with reference to FIG.
FIG. 3 shows a configuration example inside the security incident identification device 111.
In FIG. 3, 110 is an intrusion detection device (detection device), 111 is a security incident identification device (security management device), 112 is a security information collection device, 300 is a database management unit, 301 is a user input unit, and 302 is incident meta information. Database, 303 unauthorized access feature parameter extraction unit (detection security incident information receiving unit), 304 incident meta information extraction unit, 305 incident scenario synthesis unit (occurrence scenario generation unit), 306 scenario score calculation unit (evaluation value setting) Part), 307 denotes a synthetic scenario database, and 308 denotes a synthetic scenario display part (display part).

The database management unit 300 generates a security incident such as information related to security collected from an information site on the Internet by the security information collection device 112 or information specific to the monitored network input by the user via the user input unit 301. Various information as constituent elements of the scenario is input to the incident meta information database 302 sequentially or periodically.
At that time, tag information relating to information to be stored is extracted and input into a database in a format that can be searched and retrieved.
Here, the tag information is information about what kind of information the collected security information relates to, either manually or automatically extracted. For example, if it is information about a worm, the type (worm) Information on security attributes (computer security attributes / features) such as the date and time of discovery, the identifier of the vulnerability to be exploited, the spread type of infection (spread by e-mail, direct infection from the network, etc.) Is tag information.
In addition, if the countermeasure is clarified, it is associated with countermeasure information (information on the patch for correcting the vulnerability, setting contents of the security device, etc.).
The tag assigned by the database management unit 300 is used as a keyword search target when the incident meta information extraction unit 304 extracts incident meta information that may be related to unauthorized access detected by the intrusion detection device 110. Become.

  The user input unit 301 is a user interface that enables a user to input the database of incident meta information unique to the monitoring target network, manually add tag information, and manage the incident meta information database.

  In the incident meta information database 302, incident meta information data tagged with the database management unit 300 with respect to the security related information collected by the security information collection device 112 and the information input by the user from the user input unit 301. In a searchable format.

The unauthorized access feature parameter extraction unit 303 receives feature parameter information (detected security incident information) related to unauthorized access detected by the intrusion detection device 110, and extracts a feature parameter (security attribute) indicated in the received feature parameter information. .
The characteristic parameters include, for example, when network unauthorized access is detected, detection time, communication protocol, destination port number, source and destination IP address, source and destination area and country names, organization information, attack type (worm) DoS: Denial of Service (scanning).

The incident meta information extraction unit 304 converts the unauthorized access feature parameters specified by the unauthorized access feature parameter extraction unit 303 into incident meta information stored in the incident meta information database as a search key alone or in combination. The assigned tag portion is searched, and incident meta information that may be related to unauthorized access detected by the intrusion detection device 110 is extracted.
In other words, the incident meta information extraction unit 304 extracts incident meta information indicating tag information that matches a feature parameter indicated in the feature parameter information within a predetermined range.

The incident scenario composition unit 305 combines the individual incident meta information extracted by the incident meta information extraction unit 304 to synthesize a security incident scenario.
However, at the time of scenario synthesis, the scenario that is clearly redundant is deleted to reduce the number of scenarios to be synthesized.
Whether or not the scenario is redundant is determined based on the correlation between the incident meta information.
The correlation is a formally representing the relationship when new incident meta information is related to existing incident meta information. Conceptually, the correlation is a link (one direction) from new incident meta information to existing incident meta information. When the new incident meta information is related to a plurality of existing incident meta information, a link to each incident meta information (star type centering on the new incident meta information) is provided.

FIG. 11 shows the correlation between incident meta information.
For example, in FIG. 11A, when the incident meta information B is additional information related to another incident meta information A, and the incident meta information C is additional information of the incident meta information B, the meta information C and the meta information A scenario in which both scenario elements of B are included at the same time and a scenario in which both scenario elements of meta information B and meta information A are included at the same time remain, but a scenario element of C is included but a scenario element of meta information B is not included Is deleted (not adopted as a scenario), and a scenario including a scenario element of meta information B but not including a scenario element of meta information A is deleted (not adopted as a scenario).
In the example of FIG. 11 (b), when scenario elements of incident meta information that should be included at the same time are not included in the same scenario, such a scenario is unnecessary and is therefore deleted.
That is, since the meta information A and the meta information B and the meta information A and the meta information C have a correlation, the meta information A having a correlation with the meta information B or the scenario including the meta information C is correlated. Scenarios that do not include are deleted because they are redundant scenarios.
Since there is no correlation between the meta information B and the meta information C, they may be included in the same scenario at the same time.
Such correlation information indicating a correlation between incident meta information is stored in the incident meta information database 302.
Then, according to the composite scenario reduction policy as described above, for example, as shown in FIG. 11C, in the correlation information, the information of the specific attack B (for example, meta information of the specific worm) and the vulnerability A It is described that there is a correlation with information (for example, vulnerability meta information targeted by the specific attack B).
This is because if the scenario element of the incident meta information of the specific attack B is included in the scenario, the scenario element of the incident meta information of the vulnerability A targeted by the specific attack B is always included in the scenario. The scenario element of the incident meta information of the vulnerability C that is not targeted by the specific attack B (that is, has no correlation) must not be included in the same scenario as the scenario element of the incident meta information of the specific attack B. Such scenarios are subject to deletion.

In the scenario score calculation unit 306, for each scenario synthesized by the incident scenario synthesis unit 305, an index for determining whether the scenario is a security incident occurrence scenario of unauthorized access detected by an intrusion detection device to be identified A scenario score (evaluation value) is calculated and assigned.
The scenario score is quantified based on the novelty of incident meta information, the number of incident meta information, and a weighting factor of scenario elements constituting the occurrence scenario.
For example, the weight of each information with respect to the reciprocal of the difference between the date of detection of unauthorized access and the date of incident meta information of individual scenario elements that compose the combined scenario (however, detection time> date of information) Quantify by multiplying the coefficients and adding them together.
In other words, a scenario including newer information, more information, and information with a higher weighting coefficient is represented with a higher score.
This is based on the fact that due to the characteristics of security incidents, countermeasures are sequentially implemented for security incidents that have occurred in the past, and are less likely to occur over time.
However, when there is no information regarding unauthorized access detected by the intrusion detection device 110 (when it is a completely unknown unauthorized access), the incident scenario composition unit 305 does not correctly generate a security incident occurrence scenario. Cases are also conceivable.
Therefore, when a threshold is set for the scenario score and a scenario having a scenario score exceeding the threshold is not synthesized, a scenario “unknown illegal access occurs” is generated, and the scenario score has the same value as the threshold. Is granted. As a result, even if a completely unknown attack is detected, it is possible to prevent the content of the security incident from being specified by an erroneous occurrence scenario.

  In the synthesis scenario database 307, the scenario synthesized by the incident scenario synthesis unit 305 and the scenario score assigned by the scenario score calculation unit 306 are stored in association with each scenario.

  In the synthesis scenario display unit 308, the synthesis scenario and the scenario score stored in the synthesis scenario database 307 are read and displayed to the user.

Next, the operation of the security incident identification device 111 will be described with reference to the flowcharts of FIGS. 3, 4, and 8 to 11.
In the following description, for example, an A worm variant (a worm derived from the A worm) is generated on the monitored network 101, and an A worm variant is generated in the intrusion detection device 110. Suppose that an abnormality caused by this is detected.
However, it should be noted that at the time of detecting an abnormality in the intrusion detection device 110, it is unknown that the detected abnormality is caused by the occurrence of a variant of the A worm.

First, an operation example of the security incident identification device 111 during normal operation (when unauthorized access is not detected) will be described with reference to the flowchart of FIG.
In the security incident identification device 111, the database management unit 300 normally receives the security information from the security information collection device 112 and inputs information from the user via the user input unit 301 (S801).
Then, the database management unit 300 extracts tag information from the collected security information (S802), and registers the security information extracted from the tag information in the incident meta information database 302 as a record of incident meta information (S803).

  In the example of FIG. 4, incident meta information such as worm information 411 (worm name: A worm, B worm) and vulnerability information 412 (vulnerability ID: XX_123, XX_125) is collected and registered in the incident meta information database 302. It is in a state that has been.

Next, an operation example of the security incident identification device 111 when the intrusion detection device 110 monitoring the monitored network 101 detects the occurrence of unauthorized access will be described with reference to FIG.
First, the content of unauthorized access detected by the intrusion detection device 110 is notified to the security incident identification device 111 as feature parameter information. In the security incident identification device 111, the unauthorized access feature parameter extraction unit 303 receives the feature parameter information ( S901) (Detection security incident information reception step).
Next, in the security incident identification device 111, the unauthorized access feature parameter extraction unit 303 extracts feature parameters from the unauthorized access feature parameter information detected by the intrusion detection device 110 (S902).
In the example shown in FIG. 4, (1) the detected date is 10:10:10 on October 10, 2006, and (2) the destination of unauthorized access is the TCP / 80 port, in the example shown in FIG. (3) The feature parameter that the attack type is a worm is extracted.

Next, the incident meta information extraction unit 304 searches the incident meta information database 302 using the obtained feature parameter as a search key, and extracts incident meta information related to the intrusion event (unauthorized access) detected by the intrusion detection device 110. (S903) (database search step) (incident meta information extraction step).
In the example of FIG. 4, if the incident meta-information database 302 is searched using the extracted feature parameters (1), (2), and (3) as a search key, (A) information on the A worm, (B Four pieces of incident meta information are extracted: information relating to vulnerability XX_123, information relating to (C) information relating to vulnerability XX_125, and information relating to (D) A worm epidemic warning.
That is, in the worm information 411, the protocol: TCP, the related port: 80, which match the characteristic parameters of (2) the destination of unauthorized access is the TCP / 80 port, (3) the attack type is the worm, Attack type: (A) Information on A worm having tag information of worm is extracted.
Similarly, in the vulnerability information 412, (2) the destination of unauthorized access is a TCP / 80 port, and (3) the attack type is a worm, it matches the feature parameters, protocol: TCP, related port: 80, (B) Information relating to the vulnerability XX_123, (C) Information relating to the vulnerability XX_125, which has tag information of-(attack type does not matter), is extracted.
Similarly, in the security situation information 413, the protocol: TCP, the related port: match the characteristic parameters that (2) the destination of unauthorized access is the TCP / 80 port, and (3) the attack type is the worm. 80, information on (D) A worm epidemic warning having tag information of attack type: worm is extracted.

Next, the incident scenario synthesis unit 305 combines the incident meta information extracted as a result of the search to synthesize an incident scenario (S904) (occurrence scenario generation step).
The detailed procedure of the incident scenario synthesis will be described later together with the flowchart of FIG.
Here, the concept of incident scenario composition will be described using the example of FIG.
A scenario of occurrence of a security incident is synthesized by combining scenario elements included in each of the extracted incident meta information (A), (B), (C), and (D).
Simply, there are 15 (2 4 -1) combinations, but redundant combinations of scenarios are deleted based on the correlation between incident meta information.
In the example of FIG. 4, (D) is additional information related to (A), leaving only the scenario in which the scenario elements (D) and (A) are included at the same time, and (A) or (D) Scenarios that are included alone are subject to deletion.
Further, since (A) is information on a worm that attacks the vulnerability of (B), it can be said that (B) is always included in a scenario including (A). That is, only the scenario in which the scenario elements (A) and (B) are included at the same time is left, and the scenario in which (A) or (B) is included as a single unit is to be deleted.
On the other hand, since (A) is not a worm that attacks the vulnerability of (C), the scenario including both (A) and (C) is contradictory to the fact. For this reason, a scenario in which scenario elements (A) and (C) are included at the same time is to be deleted.
As described above, the correlation between such incident meta information is indicated in the correlation information, and the incident scenario composition unit 305 refers to the correlation information and generates a scenario.
Based on the above, if the synthesis scenario is narrowed down, scenario 1: (A)-(B)-(D), scenario 2: (B)-(C), scenario 3: (B), scenario 4: (C) In addition, the scenario 5 is narrowed down to a total of five scenarios: “a scenario that does not include any incident meta information” (= an unknown worm occurrence scenario). FIG. 5 shows these scenarios replaced with easy-to-understand sentences.

Next, the scenario score calculation unit 306 calculates a scenario score for the combined scenario (S905).
For the sake of simplification, the scenario score (sum of the unauthorized access detection time and the difference between the dates of the individual incident meta information constituting the synthesized scenario) when the weighting factor is 1 and the threshold is 0.0111 is used. When calculated, scenario 1: 1.1444, scenario 2: 0.0889, scenario 3: 0.0333, scenario 4: 0.0555. The scenario score for scenario 5 is 0.0111 because it is equal to the threshold value by definition.
Therefore, in the example used for the description, the highest score is assigned to scenario 1.

FIG. 12 shows a scenario score calculation formula for each scenario.
The scenario score calculation formula will be described using scenario 1 as an example.
For generation of scenario 1, scenario elements of meta information (A), (B), and (D) are used.
The date of the meta information (A) is October 1, 2006, the date of the feature parameter is October 10, 2006, and the difference between the two dates is nine days. In the meta information (B), the difference is 30 days, and in the meta information (C), the difference is one day. By adding the reciprocal of these date differences, a scenario score of 1.1444 is obtained as shown in FIG.
For scenarios 2 to 4, scenario scores are obtained by the same calculation.
For scenario 5, since there is no meta information and the scenario score becomes 0, a threshold value of 0.0111 (in this example, the reciprocal of 90 days is set as the threshold value) is set.

As described above, the scenario score calculation unit 306 is indicated in the tag information (date in the above example) and the characteristic parameter information indicated in the corresponding incident meta information for each scenario element used for generating the occurrence scenario. Set an evaluation value (in the above example, the reciprocal of the number of days difference) based on the degree of approximation with the feature parameter of unauthorized access (date in the above example), and add the evaluation value for each scenario element to evaluate the generated scenario Set (scenario score).
In addition, the scenario score calculation unit 306 assigns a higher value to a new scenario element, sets an evaluation value for each scenario element, and sets an evaluation value for the scenario by adding the evaluation values for each scenario element. .
Furthermore, the scenario score calculation unit 306 sets a threshold value for the evaluation value of the occurrence scenario, and when the evaluation value of any occurrence scenario is below the threshold value, the evaluation value of the occurrence scenario is set to the same value as the threshold value. It is set to.
In the above example, in order to simplify the explanation, the difference is taken with the date as the minimum unit, but the difference may be taken with a smaller unit such as hour, minute, second as the minimum unit. In this way, if the minimum unit is set to a fine unit, the scenario score can be defined in more detail in correspondence with the time difference between the time when the incident meta information is created and the time when unauthorized access occurs.

  Next, the synthesized scenarios and the scenario scores calculated for them are stored in the synthesized scenario database 307 (S906) and displayed to the user through the synthesized scenario display unit 308.

Next, the operation in the incident scenario synthesis process (occurrence scenario generation step) will be described with reference to FIG.
First, the incident scenario synthesis unit 305 synthesizes scenario candidates by simply combining the scenario elements of the extracted N pieces of incident meta information (S1001).
Next, the incident scenario synthesis unit 305 selects one scenario candidate from the synthesized scenario candidates (S1002), and the incident meta information in which correlation information exists in the incident meta information constituting the selected scenario candidate is obtained. It is determined whether or not there is (S1003).
If there is no incident meta information in which correlation information exists, the incident scenario synthesis unit 305 proceeds to S1009 and adds the scenario candidate to the list of synthesis scenarios.
On the other hand, when there is incident meta information in which correlation information exists, the incident scenario composition unit 305 selects one of the incident meta information in which correlation information exists (S1004), and It is determined whether or not the incident meta information that is correlated with the incident meta information in the correlation information is included in the scenario candidate selected in S1002 (S1005).

In the case of “No” in S1005, the scenario candidate does not include a correlated scenario element. Therefore, the scenario candidate is to be deleted, and the incident scenario composition unit 305 proceeds to S1010, and for all scenario candidates. If a redundant investigation is being performed, the process is terminated. If there is a scenario candidate that has not been investigated, the process returns to S1002 to investigate the next scenario candidate.
On the other hand, if “Yes” in S1005, the incident scenario composition unit 305 further determines whether or not the selected incident meta information is attack information about an attack (such as a worm) that attacks a specific vulnerability. (S1006) If so, it is further determined whether or not vulnerability information other than the vulnerability attacked by the attack targeted by the incident meta information is included (S1007).
Here, in order to simplify the explanation, the incident meta information is attack information (for example, (A) information on A worm, (D) A worm epidemic warning in FIG. 4) and specific vulnerability. It is divided into vulnerability information (for example, (B) information related to vulnerability XX_123, (C) information related to vulnerability XX_125). The correlation information indicates that there is a correlation between specific attack information and specific vulnerability information.
If “No” in S1006, that is, if the scenario element of the incident meta information of the vulnerability that is not targeted for attack is not included in the scenario candidate, the incident meta information having the correlation information is included in the scenario candidate. (S1008), and if all of the incident information having correlation information has been verified, the candidate scenario to be verified is added to the combined scenario list.
Then, the incident scenario composition unit 305 proceeds to S1010, ends the processing if redundant investigations are performed for all scenario candidates, and returns to S1002 if there are remaining scenario candidates that have not been investigated. Investigate the next scenario candidate.
On the other hand, if “Yes” in S1007, the scenario is a deletion target, so the process proceeds to S1010 without adding the combined scenario to the list.
In accordance with the above procedure, the incident scenario composition unit 305 performs composition of the scenarios to complete the scenario as shown in FIG.

As described above, when security-related information or information specific to the monitored network is registered in the incident meta information database, and the intrusion detection device 110 based on the abnormality detection method detects unauthorized access, By extracting incident meta information related to the unauthorized access, and further synthesizing the generated scenarios based on the extracted incident meta information, it is possible to identify the occurrence scenario of the security incident.
In addition, a scenario score is given to the generated scenario of the security incident, and it can be used as an index for narrowing down the scenario of the security incident actually generated from the combined scenario.
As a result, the details of the security incident that has occurred can be specified immediately after the unauthorized access is detected, so that the best measures can be taken early against unauthorized access.

As described above, in the present embodiment, the security incident identification device having the following functions has been described.
1) A database management function for tagging security-related information collected from the Internet and information input by a user input function and storing it in the incident meta information database,
2) Unauthorized access feature parameter extraction for extracting unauthorized access feature parameters as search keys when extracting incident meta information from the incident meta information database from information included in an anomaly detection event detected by an intrusion detection device function,
3) Incident meta information extraction for extracting incident meta information related to unauthorized access detected by the intrusion detection device from the incident meta information database using the unauthorized access feature parameter extracted by the unauthorized access feature parameter extraction function as a search key. function,
4) An incident scenario composition function for combining the incident meta information extracted by the incident meta information extraction function to synthesize a security incident occurrence scenario,
5) A scenario score calculation function for assigning a scenario score as an evaluation index of the scenario contents to the scenario synthesized by the incident scenario synthesis function,
6) A synthetic scenario database for storing the scenario synthesized by the incident scenario synthesis function and the scenario score assigned to the scenario.
7) A synthetic scenario display function for extracting a synthetic scenario from a synthetic scenario database and displaying it to the user.

Embodiment 2. FIG.
In the first embodiment described above, after unauthorized access is detected by the intrusion detection device, related incident meta information is extracted from the incident meta information database based on the unauthorized access feature parameter, and a security incident occurrence scenario is synthesized. However, depending on the number of extracted incident meta information, the number of combinations may increase, and it may take time to synthesize scenarios.

Therefore, in the present embodiment, in the normal time, scenario synthesis processing is performed in parallel with the registration of information in the incident meta information database, and the synthesized scenario is stored in the synthesis scenario database, and the intrusion detection device 110 performs fraud. When an access is detected, a scenario related to a detected unauthorized access is identified by extracting a related scenario from already synthesized scenarios.
In addition, since the scenario is synthesized from the normal time and stored in the synthesis scenario database, the user appropriately reads out the scenario from the synthesis scenario database, and based on the scenario of a security incident that may occur in the future, Proactive measures can be taken.

FIG. 6 shows a configuration example of the security incident identification device 111 according to the present embodiment.
In FIG. 6, an incident scenario selection unit 309 (occurrence scenario selection unit) is added as compared with the configuration of FIG. The other components are the same as those described with reference to FIG. In the present embodiment, the synthesis scenario database 307 functions as an occurrence scenario database.
The incident scenario selection unit 309 selects an incident scenario that matches the feature parameter from the incident scenarios stored in the synthetic scenario database 307 when the intrusion detection device 110 detects unauthorized access and the feature parameter information is transmitted. . Incident scenarios stored in the combined scenario database are generated in advance by the incident scenario combining unit 305.

That is, in the present embodiment, before detecting unauthorized access, for example, when new incident meta information is stored in the incident meta information database 302, the incident meta information extraction unit 304 searches the incident meta information database, Incident meta information having tag information that matches the tag information (security attribute) of the new incident meta information within a predetermined range is extracted (database search step).
For example, if incident meta information related to “A worm epidemic warning” is collected, date, protocol, related port, attack type, etc. can be obtained as related tag information (information equivalent to that at the time of intrusion detection). This is used for incident meta information extraction to extract incident meta information with matching tag information.
Then, in the same procedure as in the first embodiment, the incident scenario composition unit 305 determines the scenario elements correlated with the scenario elements of the new incident meta information from the extracted incident meta information scenario elements. A scenario is generated by combining scenario elements (occurrence scenario generation step).
Further, the incident scenario composition unit 305 associates the tag information of the incident meta information used for generating each scenario with each scenario. That is, for example, when scenario 1 (combination pattern: (A)-(B)-(D)) shown in FIG. 5 is generated, a tag for information on scenario 1 and (A) A worm shown in FIG. The corresponding part of the information 421, (B) the corresponding part of the tag information 422 of the information related to the vulnerability XX_123, and (D) the corresponding part of the tag information 423 of the A worm epidemic warning are associated with each other.
Next, the incident scenario synthesis unit 305 stores the generated scenario in the synthesis scenario database (database storage step).
When the unauthorized access feature parameter extraction unit 303 receives the feature parameter information from the intrusion detection device 110 (security incident information reception step), the incident scenario selection unit 309 displays the unauthorized access feature parameters indicated in the feature parameter information. Based on the tag information (security attribute) related to the scenario element used to generate each occurrence scenario, a specific occurrence scenario is selected from the occurrence scenarios stored in the synthetic scenario database 307 ( Occurrence scenario selection step).
The incident scenario selection unit 309 associates tag information (date, protocol, related port, attack type, etc.) that matches the characteristic parameter (date, protocol, destination port, attack type, etc.) indicated in the characteristic parameter information. Select a scenario.
Thereafter, as in the first embodiment, the scenario score calculation unit 306 gives a scenario score to the selected scenario, and the combined scenario display unit 308 displays the selected scenario and its scenario score.

In the second embodiment described above, by generating a security incident occurrence scenario in advance before unauthorized access is detected, it is possible to speed up identification of a security incident occurrence scenario after unauthorized access detection.
In addition, the user can analyze a risk related to a possible security incident in the future by looking at a scenario synthesized in advance, and can take a precaution.

In the second embodiment, the security incident identification device having the following functions has been described.
1) A database management function for tagging security-related information collected from the Internet and information input by a user input function and storing it in the incident meta information database,
2) Incident meta information extraction function for extracting related incident meta information from the incident meta information database using the tag information of the incident meta information newly added to the incident meta information database as a search key,
3) An incident scenario composition function for combining the incident meta information extracted by the incident meta information extraction function to synthesize the occurrence scenario of the security incident,
4) A synthetic scenario database for storing scenarios synthesized by the incident scenario synthesis function and scenario scores assigned to the scenarios.
5) Unauthorized access feature parameter extraction function for extracting from the information included in the abnormality detection event detected by the intrusion detection device as an unauthorized access feature parameter as a search key when extracting a synthesis scenario from the synthesis scenario database;
6) A scenario score calculation function for assigning a scenario score as an evaluation index of the scenario content to the scenario extracted from the synthetic scenario database.
7) A synthetic scenario display function for displaying the extracted synthetic scenario to the user.

Embodiment 3 FIG.
In the first embodiment and the second embodiment described above, the security incident occurrence scenario synthesized by the security incident identification device 111 is registered in the synthesis scenario database 307, which is automatically requested by the user or automatically. It is displayed on the screen.
However, in this case, since it is the user who actually takes measures to suppress damage against detected unauthorized access, the operating cost is high, and the damage increases until countermeasures are taken. There is also a risk.
Therefore, in the third embodiment, in addition to the functions of the security incident identification device 111 described in the first and second embodiments, an automatic countermeasure function is provided, and monitoring is performed according to the derived security incident occurrence scenario. It is possible to take countermeasures in cooperation with countermeasures on the target network (general security countermeasure devices including Firewall, router, IDS (Intrusion Detection System)).

FIG. 7 shows a configuration example of the security incident identification device 111 according to the present embodiment.
In FIG. 7, a countermeasure measure execution unit 310 is added as compared with the configuration of FIG. The other components are the same as those described with reference to FIG.
In FIG. 7, the countermeasure implementation unit 310 is added to the configuration of FIG. 3, but the countermeasure implementation unit 310 may be added to the configuration of FIG. 6.
In the security incident identification device 111 according to the present embodiment, processes related to incident meta information collection management, scenario generation, and scenario score calculation are the same as those in the first and second embodiments.

The countermeasure implementation unit 310 implements countermeasures for dealing with the security incident in association with the scenario with the highest score among the scenarios with the scenario score set by the scenario score calculator 306.
Specifically, the countermeasure measure execution unit 310 remotely connects to a security countermeasure device such as a firewall, a router, and an IDS installed on the monitoring target network 101 to change access control settings and the like.
For example, in the example described in the first embodiment, the five scenarios shown in FIG. 5 are generated, and among them, the scenario score is the highest (scenario score = 1.1444). Combination pattern (A) -When measures are taken in accordance with the scenario (B)-(D), the countermeasure measure execution unit 310 is set to primarily control the bandwidth of the TCP / 80 port traffic in the firewall and router (the effect of the worm is affected). IDS automatically implements measures such as enabling the signature if there is an A worm signature.

  In the third embodiment described above, cooperation with countermeasure means (general security countermeasure devices including Firewall, router, IDS) on the monitoring target network according to the security incident occurrence scenario synthesized by the security incident identification device Therefore, it is possible to implement early measures aimed at reducing damage expansion without incurring human costs.

  In this embodiment, by providing an automatic countermeasure function, it is possible to identify a security incident that can be taken in cooperation with countermeasure means (Firewall, router, etc.) on the monitored network for the identified security incident. The apparatus has been described.

Finally, hardware configuration examples of the intrusion detection device 110, the security incident identification device 111, and the security information collection device 112 described in the first to third embodiments will be described.
FIG. 13 is a diagram illustrating an example of hardware resources of the intrusion detection device 110, the security incident identification device 111, and the security information collection device 112 described in the first to third embodiments. The configuration in FIG. 13 is merely an example of the hardware configuration of the intrusion detection device 110, the security incident identification device 111, and the security information collection device 112. The intrusion detection device 110, the security incident identification device 111, and the security information The hardware configuration of the collection device 112 is not limited to the configuration illustrated in FIG. 13, and may be another configuration.

In FIG. 13, an intrusion detection device 110, a security incident identification device 111, and a security information collection device 112 are a CPU 911 (Central Processing Unit, a central processing unit, a processing unit, a processing unit, a microprocessor, a microcomputer, and a processor that execute programs. Say). The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices. Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of a storage device or a storage unit.
The communication board 915, the keyboard 902, the scanner device 907, the FDD 904, and the like are examples of an input unit and an input device.
Further, the communication board 915, the display device 901, the printer device 906, and the like are examples of an output unit and an output device.

As shown in FIG. 1, the communication board 915 is connected to a network. For example, the communication board 915 may be connected to a LAN (local area network), the Internet, a WAN (wide area network), or the like.
The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924. The programs in the program group 923 are executed by the CPU 911, the operating system 921, and the window system 922.

The program group 923 stores programs that execute the functions described as “˜unit” and “˜function” in the description of the first to third embodiments. The program is read and executed by the CPU 911.
In the file group 924, in the description of the first to third embodiments, “determination of”, “calculation of”, “comparison of”, “evaluation of”, “extraction of”, “update of” ”,“ Setting of ”,“ synthesis of ”,“ generation of ”,“ registration of ”, etc. It is stored as each item of "~ file" and "~ database". The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, Used for CPU operations such as calculation, calculation, processing, editing, output, printing, and display. Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
The arrows in the flowcharts shown in the first to third embodiments mainly indicate input / output of data and signals. The data and signal values are the memory of the RAM 914, the flexible disk of the FDD904, the compact disk of the CDD905, and the magnetic disk device 920. Recording media such as magnetic disks, other optical discs, mini discs, DVDs, and the like. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In addition, in the description of the first to third embodiments, what is described as “to part” and “to function” may be “to circuit”, “to device”, and “to device”. , “˜step”, “˜procedure”, and “˜processing”. That is, what is described as “˜unit” and “˜function” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “˜unit” and “˜function” of the first to third embodiments. Alternatively, the procedures and methods of “˜unit” and “˜function” of the first to third embodiments are executed by a computer.

  As described above, the intrusion detection device 110, the security incident identification device 111, and the security information collection device 112 shown in the first to third embodiments include a CPU as a processing device, a memory as a storage device, a magnetic disk, etc., a keyboard and a mouse as input devices. , A computer including a communication board, an output device, a display device, a communication board, etc. As described above, the functions indicated as “to part” and “to function” are the processing device, storage device, input device, and output. This is realized using an apparatus.

FIG. 3 is a diagram illustrating an example of a system configuration according to the first embodiment. The figure explaining a prior art. FIG. 3 is a diagram illustrating a configuration example of a security incident identification device according to the first embodiment. The figure which shows the example of the incident meta-information database which concerns on Embodiment 1. FIG. FIG. 3 is a diagram illustrating a scenario synthesis example according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of a security incident identification device according to a second embodiment. FIG. 10 is a diagram illustrating a configuration example of a security incident identification device according to a third embodiment. FIG. 4 is a flowchart showing an example of normal operation of the security incident identification device according to the first embodiment. The flowchart figure which shows the operation example at the time of the intrusion detection of the security incident specific device which concerns on Embodiment 1. FIG. The flowchart figure which shows the operation example of the incident scenario synthetic | combination process of the security incident specific device which concerns on Embodiment 1. FIG. The figure which shows the synthetic | combination scenario number reduction policy using the correlation of the incident meta information which concerns on Embodiment 1. FIG. FIG. 5 shows an example of a scenario score calculation formula according to Embodiment 1. The figure which shows the hardware structural example of the intrusion detection apparatus which concerns on Embodiment 1-3, a security incident specific apparatus, and a security information collection apparatus.

Explanation of symbols

  100 Internet, 101 Monitored Network, 110 Intrusion Detection Device, 111 Security Incident Identification Device, 112 Security Information Collection Device, 300 Database Management Unit, 301 User Input Unit, 302 Incident Meta Information Database, 303 Unauthorized Access Feature Parameter Extraction Unit, 304 Incident meta information extraction unit, 305 incident scenario synthesis unit, 306 scenario score calculation unit, 307 synthesis scenario database, 308 synthesis scenario display unit, 309 incident scenario selection unit, 310 countermeasure measure implementation unit.

Claims (16)

A security management device connected to a detection device that detects the occurrence of a security incident in a monitoring target,
An incident meta information database for storing a plurality of incident meta information indicating scenario elements which are elements of a security incident occurrence scenario and security attributes related to the scenario elements;
A detection security incident information receiving unit for receiving detection security incident information indicating a security attribute of a detection security incident detected by the detection device from the detection device;
An incident meta information extracting unit that extracts incident meta information indicating a security attribute that matches the security attribute of the detected security incident indicated in the detected security incident information within a predetermined range;
A security management apparatus comprising: an occurrence scenario generation unit that generates an occurrence scenario of a detected security incident using a scenario element indicated in the incident meta information extracted by the incident meta information extraction unit. The security management device further includes:
The security management apparatus according to claim 1, further comprising an evaluation value setting unit that sets an evaluation value for the occurrence scenario generated by the occurrence scenario generation unit. The incident meta information extraction unit
Extract two or more incident meta information,
The occurrence scenario generation unit
The occurrence scenario is generated by combining the scenario elements correlated with each other among the scenario elements indicated by the two or more incident meta information extracted by the incident meta information extraction unit. Security management device. The security management device further includes:
The security management according to claim 2, further comprising a display unit that displays the generated scenario generated by the generated scenario generation unit and the evaluation value set by the evaluation value setting unit for the generated scenario. apparatus. A security management device connected to a detection device that detects the occurrence of a security incident in a monitoring target,
An incident meta information database for storing a plurality of incident meta information indicating scenario elements which are elements of a security incident occurrence scenario and security attributes related to the scenario elements;
An occurrence scenario generation unit that generates a security incident occurrence scenario by combining two or more scenario elements having security attributes that match and correlate within a predetermined range among the scenario elements indicated in the plurality of incident meta information;
An occurrence scenario database for storing the occurrence scenario generated by the occurrence scenario generation unit;
A detection security incident information receiving unit for receiving detection security incident information indicating a security attribute of a detection security incident detected by the detection device from the detection device;
The occurrence scenario stored in the occurrence scenario database based on the security attribute of the detection security incident indicated in the detection security incident information and the security attribute related to the scenario element used to generate each occurrence scenario. A security management apparatus comprising: an occurrence scenario selection unit that selects a specific occurrence scenario from the inside. The security management device further includes:
The security management apparatus according to claim 5, further comprising an evaluation value setting unit that sets an evaluation value for the occurrence scenario selected by the occurrence scenario selection unit. The security management device further includes:
The security management according to claim 6, further comprising a display unit that displays an occurrence scenario selected by the occurrence scenario selection unit and an evaluation value set by the evaluation value setting unit for the occurrence scenario. apparatus. The evaluation value setting unit
For each scenario element used to generate an occurrence scenario for which an evaluation value is to be set, the degree of approximation between the security attribute indicated in the corresponding incident meta information and the security attribute of the detected security incident indicated in the detected security incident information is The security management device according to claim 2 or 6, wherein an evaluation value is set based on the evaluation value, and an evaluation value for each scenario element is added to set the evaluation value of the generated scenario. The evaluation value setting unit
A higher value is assigned to a new scenario element, an evaluation value is set for each scenario element used to generate an occurrence scenario for which an evaluation value is to be set, and the evaluation value for each occurrence is calculated by adding the evaluation value for each scenario element. The security management device according to claim 2, wherein the security management device is set. The evaluation value setting unit
A threshold value is set for the evaluation value of the occurrence scenario, and when the evaluation value of any occurrence scenario is lower than the threshold value, the evaluation value of the occurrence scenario is set to the same value as the threshold value. The security management device according to claim 2 or 6. The security management device further includes:
7. The apparatus according to claim 2, further comprising a countermeasure implementation unit that implements a countermeasure for dealing with the detected security incident in association with the occurrence scenario in which the evaluation value is set by the evaluation value setting unit. Security management device. The countermeasure implementation department
When there are a plurality of occurrence scenarios for which an evaluation value is set by the evaluation value setting unit, a countermeasure is taken to deal with the detected security incident in association with the occurrence scenario with the highest evaluation value. The security management device according to claim 11. A security management method using a computer connected to a detection device that detects the occurrence of a security incident in a monitoring target,
A database search step in which a computer searches for an incident meta information database storing a plurality of incident meta information indicating scenario elements which are elements of a security incident occurrence scenario and security attributes related to the scenario elements;
A detection security incident information receiving step in which a computer receives detection security incident information indicating a security attribute of a detection security incident detected by the detection device from the detection device;
Incident meta information extraction step for the computer to extract incident meta information indicating a security attribute that matches the security attribute of the detected security incident indicated in the detected security incident information within a predetermined range;
A security management method comprising: an occurrence scenario generation step in which a computer generates an occurrence scenario of a detected security incident using a scenario element indicated in the incident meta information extracted by the incident meta information extraction step. A security management method using a computer connected to a detection device that detects the occurrence of a security incident in a monitoring target,
A database search step in which a computer searches for an incident meta information database storing a plurality of incident meta information indicating scenario elements which are elements of a security incident occurrence scenario and security attributes related to the scenario elements;
Generation scenario generation in which a computer generates a security incident occurrence scenario by combining two or more scenario elements whose security attributes are matched and correlated in a predetermined range among the scenario elements indicated in the plurality of incident meta information Steps,
A database storage step in which the computer stores the occurrence scenario generated by the occurrence scenario generation step in an occurrence scenario database;
A detection security incident information receiving step in which a computer receives detection security incident information indicating a security attribute of a detection security incident detected by the detection device from the detection device;
The computer is stored in the occurrence scenario database based on the security attributes of the detected security incidents indicated in the detected security incident information and the security attributes related to the scenario elements used to generate each occurrence scenario. A security management method comprising: a generation scenario selection step of selecting a specific generation scenario from the generation scenarios. To a computer connected to a detection device that detects the occurrence of a security incident in the monitoring target,
A database search process for searching an incident meta information database for storing a plurality of incident meta information indicating a scenario element which is an element of a security incident occurrence scenario and a security attribute related to the scenario element;
Detection security incident information receiving processing for receiving detection security incident information indicating a security attribute of a detection security incident detected by the detection device from the detection device;
Incident meta information extraction processing for extracting incident meta information indicating a security attribute that matches the security attribute of the detected security incident indicated in the detected security incident information within a predetermined range;
A program for executing an occurrence scenario generation process for generating an occurrence scenario of a detected security incident using a scenario element indicated in the incident meta information extracted by the incident meta information extraction process. To a computer connected to a detection device that detects the occurrence of a security incident in the monitoring target,
A database search process for searching an incident meta information database for storing a plurality of incident meta information indicating a scenario element which is an element of a security incident occurrence scenario and a security attribute related to the scenario element;
An occurrence scenario generation process for generating an occurrence scenario of a security incident by combining two or more scenario elements whose security attributes are matched and correlated within a predetermined range among the scenario elements indicated in the plurality of incident meta information,
Database storage processing for storing the occurrence scenario generated by the occurrence scenario generation processing in the occurrence scenario database;
Detection security incident information receiving processing for receiving detection security incident information indicating a security attribute of a detection security incident detected by the detection device from the detection device;
The occurrence scenario stored in the occurrence scenario database based on the security attribute of the detection security incident indicated in the detection security incident information and the security attribute related to the scenario element used to generate each occurrence scenario. A program for executing an occurrence scenario selection process for selecting a specific occurrence scenario from among them.

Images