JP2021179777A - Attack scenario risk evaluation device and method thereof - Google Patents

Abstract

To provide an attack scenario risk evaluation method including a process until an attacker reaches a final target and efficiency thereof in a cyber attack scenario evaluation method.SOLUTION: A risk evaluation device for a cyber attack to a system consisting of a plurality of components calculates, for an attack scenario in which a component that is an attack target stored in an attack scenario storage unit 104 and attack order thereof and the number of passing components are defined, a total value of risk evaluation points for each component calculated by a risk total value calculation unit 106 as a risk evaluation point by dividing the total value by the number of passing components defined in the attack scenario by a division value calculation unit 107.SELECTED DRAWING: Figure 1

Description

The present invention relates to a technique for evaluating the risk of a cyber attack scenario.

Currently, cyber attacks on systems such as unauthorized access have become a serious problem. The system is composed of a plurality of components connected to each other. Therefore, the content of a cyber attack can be specified by an action pattern including a component that is the final target and a route to the cyber attack. Therefore, in countermeasures against cyber attacks, it is possible to specify the countermeasure points and contents by using an attack scenario that defines the attacker's final goal and the behavior pattern leading up to that goal. At that time, in order to take more effective countermeasures, the attack scenario judged to be high risk for the defender is taken as a countermeasure from the viewpoint of the possibility that the attacker actually sets up and the impact when attacked. You need to use it. Therefore, a method and a device for evaluating the risk of each attack scenario are required.
In Patent Document 1, which is a technique for evaluating the risk level of a scenario, the risk level of an attack scenario is evaluated based on the state of the attack target system when the attacker reaches the final target.

Japanese Patent No. 6106767

However, the risk assessment methods for general attack scenarios, including Patent Document 1, cannot consider the process of an attack that reaches the final target, such as the process in which an attack is likely to be launched and its efficiency. There is a problem that the behavioral habits of the attacker are not reflected.

Therefore, the present invention provides a risk assessment method for an attack scenario, including the process by which an attacker reaches the final target and its efficiency.

In order to solve the above problems, the present invention defines the components constituting the attack target, at least the attack order and the number of passing components in the evaluation of the risk of cyber attack on the system consisting of a plurality of components. An attack scenario is generated, and the risk level is evaluated based on the total value of the risk level evaluation points for each component included in the created attack scenario.

More specifically, in the attack scenario risk evaluation device for evaluating the risk of a server attack scenario against a system composed of a plurality of components, the system configuration information storage indicating the system configuration is stored. A unit, an attack scenario calculation unit that generates an attack scenario of a cyber attack indicating an attack order including at least a part of the plurality of components using the system configuration information, and each of the generated attack scenarios. The risk total value calculation unit that calculates the total risk value by adding up the component risk evaluation points that indicate the risk level of the components for each attack scenario, and the risk for each scenario based on the total risk level value. A scenario risk evaluation device that has a scenario risk evaluation point calculation unit that calculates a scenario risk evaluation point that indicates the degree.

The present invention also includes a method using the risk assessment device for the attack scenario and a program product for making the risk assessment device for the attack scenario function as a computer.

According to the present invention, it is possible to evaluate the high possibility that an attack on a process is launched by using the total value of the component risk evaluation points for each component.
Issues, configurations and effects other than those described above will be clarified by the following description of the embodiments.

It is a functional block diagram which shows the example of the functional structure of the risk evaluation apparatus of the attack scenario which concerns on Example 1. FIG. It is a figure which shows the example of the system configuration information used in Examples 1 to 3. It is a figure which shows the example of the attack content information used in Examples 1 to 3. It is a figure which shows the example of the system configuration of the attack target in Examples 1 to 3. This is an example of a flowchart for explaining the risk assessment method according to the first embodiment. It is an example of the flowchart explaining the assignment of the component risk evaluation point of step S502 of FIG. 5 which concerns on Example 1. FIG. This is an example of a graph diagram that abstracts the system configuration of the attack target according to the first embodiment. It is a figure which shows an example of the component risk degree evaluation point which concerns on Example 1. FIG. It is a figure which shows an example of the attack scenario which concerns on Example 1. FIG. It is an example of the flowchart explaining the assignment of the scenario risk evaluation point of step S505 of FIG. 5 which concerns on Example 1. FIG. It is a figure which shows the example of the scenario risk evaluation point which concerns on Example 1. FIG. It is a figure which shows the example of the screen display of the risk degree evaluation result including the scenario risk degree evaluation point which concerns on Example 1. FIG. It is a functional block diagram which shows the example of the functional structure of the risk evaluation apparatus of the attack scenario which concerns on Example 2. FIG. It is a figure which shows an example of the vulnerability information which concerns on Example 2. FIG. It is an example of the flowchart explaining the assignment of the component risk evaluation point of step S502 of FIG. 5 which concerns on Example 2. FIG. It is a figure which shows an example of the component risk degree evaluation point which concerns on Example 2. FIG. It is a figure which shows an example of the attack scenario which concerns on Example 3. FIG. This is an example of a flowchart for explaining the assignment of the scenario risk evaluation points in step S505 of FIG. 5 according to the third embodiment. It is a system configuration diagram of the risk evaluation device of the attack scenario which concerns on each embodiment.

Hereinafter, each embodiment of the present invention will be described with reference to the drawings. In each embodiment, the risk of a cyber attack on a system to which a plurality of components as shown in FIG. 4 are connected is evaluated. The components include a notebook PC 401 and the like, and the specific system configuration will be described later.

Hereinafter, Example 1 of the present invention will be described with reference to the drawings.

FIG. 1 is a functional block diagram showing a functional configuration of the risk assessment device 10 of the attack scenario of the present embodiment. Hereinafter, each block (function) will be described. The attack target system configuration storage unit 101 stores the attack target system configuration information 200. The cyber attack method storage unit 102 stores attack content information 300 indicating a cyber attack technique and a method for realizing the cyber attack technique. In the attack scenario calculation unit 103, the components to be attacked, their attack order, and the number of passing components included in the attack order are defined based on the system configuration information 200 of the system configuration storage unit 101 to be attacked. Generate an attack scenario. Being included in the attack order means passing in the attack scenario. The attack scenario 900 generated by the attack scenario calculation unit 103 is stored in the attack scenario storage unit 104.

The component risk calculation unit 105 calculates the component risk evaluation points for each component based on the information of the system configuration storage unit 101 and the cyber attack method storage unit 102. In the risk level total value calculation unit 106, the risk level for each component calculated by the system component risk calculation unit 105 is used, and the component for each component included in each attack scenario stored in the attack scenario storage unit 104. Calculate the total value of the risk evaluation points.

The division value calculation unit 107 calculates the division value by the number of passing components included in the attack order stored in the attack scenario storage unit 104 of the risk level total value calculated by the risk level total value calculation unit 106. Then, the display unit 108 displays the division value calculated by the division value calculation unit 107 as a scenario risk evaluation point indicating the risk level of the attack scenario. In addition, each storage unit or calculation unit may be a CPU or a PC itself.

In this embodiment, the division value is used as the scenario risk evaluation point, but the present invention is not limited to this. That is, it suffices if the division value calculation unit 107 can specify the scenario risk evaluation points based on the total value. In other words, the division value is an example of the scenario risk evaluation point. The scenario risk evaluation points also include representative values such as the total value itself, the median value of each component risk evaluation point, the geometric mean, and the logarithmic mean.

Further, in the summation of the component risk evaluation points in the risk sum total value calculation unit 106, in addition to addition, it is also possible to calculate a comprehensive numerical value for the entire scenario from the individual component risk evaluation points such as multiplication. included.

In addition to using the total value and the division value, the mode, maximum value, and the like of the component risk evaluation points for each scenario may be used as the scenario risk evaluation points.

FIG. 19 shows a system configuration in which the above-mentioned functional configuration of the risk assessment device 10 is realized by a computer. The risk assessment device 10 is composed of a processing unit 11 such as a CPU connected to each other by a bus or the like, a memory 12, and an input / output I / F 13. Here, the processing unit 11 has an attack scenario calculation unit 103, a component risk calculation unit 105, a risk total value calculation unit 106, and a division value calculation unit 107, which can be realized by a program. That is, in this embodiment, the program is expanded in the memory 12, and each of these functions and operations is executed by the processing unit 11.

Further, the risk assessment device 10 is connected to the storage device 14 via the input / output I / F 13. The storage device 14 stores system configuration information 200, attack content information 300, attack scenario 900, and vulnerability information 1400. That is, the storage device 14 functions as the system configuration storage unit 101, the cyber attack method storage unit 102, and the attack scenario storage unit 104 in FIG. 1. Further, the storage device 14 also stores the component risk evaluation point information 800 and the scenario risk evaluation point information 1100 calculated by the risk evaluation device 10. Further, the storage device 14 may be provided inside the risk assessment device 10.

The vulnerability information 1400 is the information used in the second embodiment, and may not be stored in the storage device 14 in the present embodiment. Further, in the second embodiment described later, the component risk evaluation point information 1600 is stored in the storage device 14 instead of the component risk evaluation point information 800. Further, the storage device 14 stores the attack scenario 1700 instead of the attack scenario 900.

Further, the risk assessment device 10 is connected to various terminal devices 16-1 and 2 via the input / output I / F 13. Each of the terminal devices 16-1 and 16-1 and 2 is realized by a computer and has a function of accepting an input from a user and displaying a processing result of the risk assessment device 10. That is, the terminal devices 16-1 and 2 2 function as the display unit 108 of FIG. Further, the terminal device 16-2 is connected to the risk assessment device 10 via the network 15. The terminal devices 16-1 and 2 may be integrated with the risk assessment device 10. That is, the risk assessment device 10 may be provided with a display device or an input / output device.

FIG. 2 is a diagram showing system configuration information 200 stored in the system configuration storage unit 101. The system configuration information 200 includes various information about each component constituting the attack target system. The system configuration information 200 is information in which the component number 210, the device name 220, the device type 230, the connection network 240, the installed OS 250, the anti-malware 260, and the authority management 270 are associated with each component.

Element number 210 is an identifier that uniquely represents a component of the system. The device name 220 is a name of a device, that is, a component, and in the example shown in FIG. 2, there are a notebook PC 1, a notebook PC 2, a desktop PC 1, a desktop PC 2, a data server 1, and the like. The device type 230 indicates a device, that is, a type of a component constituting the system. In the example of FIG. 2, it is a notebook PC, a desktop PC, and a data server. The connection network 240 is a network to which each component is connected, and in the example of FIG. 2, there are two networks, network 1 and network 2.

The OS (basic software) 250 is the type and version of the OS (basic software) installed in each component. In the example of FIG. 2, OS1 ver. 1, OS1 ver.2, OS2 ver.1, OS3, etc. The anti-malware 260 indicates the presence or absence of anti-malware measures in each component. That is, in the example of FIG. 2, if there is, it means that the component of the system has been taken measures, and if there is no measure, it means that the component has not taken measures. The authority management 270 indicates the presence or absence of authority management within each component, and in the example of FIG. 2, it is indicated that it is managed if it is present, and that it is not managed if it is not.

Here, the OS (basic software) 250, the anti-malware 260, and the authority management 270 are information indicating the countermeasure status against cyber attacks. Therefore, as will be described later, the component risk calculation unit 105 will use information indicating the countermeasure status in the component risk evaluation point calculation process (step S502).

FIG. 3 is a diagram showing attack content information 300 stored in the cyber attack method storage unit 102. The attack content information 300 is information in which the object 310, the technique 320, and the attack method 330 are associated with each other. The purpose 310 is the intended purpose of the attack, and in the case of the example of FIG. 3, there are execution of an attack code, movement to another element, and access to authentication information. The technique 320 is a technique for achieving the object 310. The example of FIG. 3 includes command line use, application programming interface (API) use, administrative shares, remote file copy, brute force attacks and account operations. The attack method 330 is a method for realizing the technology 320, and in the case of the example of FIG. 3, commands, malware, tools, and the like are included.

Next, the content of the risk assessment according to this embodiment will be described using a specific example. First, FIG. 4 shows a specific example of the attack target, that is, the system configuration to be evaluated for the degree of risk. This system is composed of a notebook PC 401, a notebook PC 402, a desktop PC 403, a desktop PC 404, a data server 405, a switch 406, and a switch 407 as components.

Then, each component is connected to another component as follows. The notebook PC 401 is connected to the notebook PC 402, the desktop PC 403, the desktop PC 404, and the switch 406. The notebook PC 402 is connected to the notebook PC 401, the desktop PC 403, the desktop PC 404, and the switch 406. The desktop PC 403 is connected to the notebook PC 401, the notebook PC 402, the desktop PC 404, the data server 405, the switch 406, and the switch 407. The desktop PC 404 is connected to the notebook PC 401, the notebook PC 402, the desktop PC 403, the data server 405, the switch 406, and the switch 407. The data server 405 is connected to the desktop PC 404, the desktop PC 405, and the switch 407.

The above 401 to 405 correspond to 1 to 5 of the element numbers 210 in FIG. The switch 406 is connected to the notebook PC 401, the notebook PC 402, the desktop PC 403, and the desktop PC 404. The switch 407 is connected to the desktop PC 403, the desktop PC 404, and the data server 405.

Further, the risk assessment device 10 may be connected to the system or may be realized as a component of the system.

FIG. 5 is an overall flow of the risk assessment method in this embodiment. Hereinafter, the overall flow will be described with reference to the functional block diagram shown in FIG.

First, in step S501, the attack scenario calculation unit 103 reads the system configuration information 200 from the system configuration storage unit 101. Then, in step S502, the component risk calculation unit 105 assigns a component risk evaluation point of the system. The details of this step S502 will be described with reference to FIG.

FIG. 6 is a flowchart showing a flow for assigning component risk evaluation points. First, in step S601, the component risk calculation unit 105 reads the attack method 330 included in the attack content information 300 from the cyber attack method storage unit 102.

Then, in step S602, the component risk calculation unit 105 selects a component to which the component risk evaluation point is given from the components constituting the system to be attacked. Here, the attack scenario calculation unit 103 may be selected by the user's designation or the use of random numbers, in addition to the selection according to a predetermined standard. As predetermined criteria, it is possible to use the importance of components, properties such as resistance to attacks, and attack history.

Then, in step S603, the component risk calculation unit 105 assigns each selected component as a component risk evaluation point of the component based on the number of effective cyber attack methods. That is, the component risk calculation unit 105 calculates the component risk evaluation points of each component.

Then, in step S604, the component risk calculation unit 105 determines whether or not the component risk evaluation points have been given to the selected components. If it is determined that the component risk evaluation points have not been assigned to each of the selected components (step S640: No), the process proceeds to step S602 to assign them to the next component. On the other hand, when it is determined that the component risk evaluation points have been given to each of the selected components (step S604: Yes), the addition of the component risk evaluation points ends.

Here, a specific example of assigning the component risk evaluation points in FIG. 6 will be described.

First, in step S601, the component risk calculation unit 105 reads the attack method 330 of the attack content information 300. That is, the command 1, the tool 1, the malware 1, and the like shown in FIG. 3 are specified.

The next step S602 will be described with reference to FIG. FIG. 7 is a graph in which the system configuration of the attack target of FIG. 4 is abstracted. That is, FIG. 7 shows a topology showing the connection status of each component of the target system.

In FIG. 7, the node 701 of the component number 1 corresponds to the notebook PC 401 of FIG. The node 702 of the component number 2 corresponds to the notebook PC 402 of FIG. The node 703 of the component number 3 corresponds to the desktop PC 403 of FIG. Node 704 of component number 4 corresponds to the desktop PC 404 of FIG. The node 705 of the component number 5 corresponds to the data server 405 of FIG. In this embodiment, the switch 406 and the switch 407 of FIG. 4 are not included in FIG. 7.

That is, the component risk calculation unit 105 performs the following processing. In step S602, the component risk calculation unit 105 selects the notebook PC 401, the notebook PC 402, the desktop PC 403, the desktop PC 404, and the data server 405. Then, the component risk calculation unit 105 generates the topology shown in FIG. 7 in consideration of these connection relationships. For this purpose, the component risk calculation unit 105 names each component represented by the topology, such as node 701 (component number 1).

Next, in step S603, the component risk calculation unit 105 calculates the number of effective cyber attack methods using the information indicating the countermeasure status of the system configuration information 200. For this purpose, the component risk calculation unit 105 first matches the countermeasure status of the component selected in step S602 with the attack method 330 read in step S601.

For this matching, the component risk calculation unit 105 specifies the countermeasure status of the selected component. For example, since the node 701 of the component number 1 is selected in step S602, the component risk calculation unit 105 specifies the record when the component number 210 of FIG. 2 is “1”. Then, the component risk calculation unit 105 specifies the contents of the OS (basic software) 250, the anti-malware 260, and the authority management 270 of the specified record. In this example, the OS (basic software) 250 of the node 701 is specified as "OS1 ver.1", the anti-malware 260 is specified as "none", and the authority management 270 is specified as "none".

Then, the component risk calculation unit 105 compares the specified content with the attack method specified in step S601. At this time, the component risk calculation unit 105 and the corresponding ones are compared with each other. Specifically, the component risk calculation unit 105 compares the following items with each other.
(1) "Command 1": Authority management 270 "None"
(2) "Tool 1": OS (basic software) 250 "OS1 ver.1"
(3) "Malware 1": Anti-malware 260 "None"
Here, the component risk calculation unit 105 determines that the attack of command 1 is valid for (1) and (3) for the node 701 (component number 1). Further, the component risk calculation unit 105 determines that the attack on the tool 1 is not effective for (2) based on the criteria recorded separately by OS1 ver.1.

As a result, the component risk calculation unit 105 calculates the number of effective attack methods against the node 701 (component number 1) as “2”.

In this way, the component risk calculation unit 105 calculates the number of effective attack methods by matching and comparing the corresponding attack methods and the countermeasure situations. Then, the component risk calculation unit 105 assigns the component risk evaluation points based on the calculated number of effective attack methods to the node 701. Here, the component risk calculation unit 105 may use the value itself of the number of effective attack methods as the component risk evaluation point, or may use a value converted from anything.

FIG. 8 is a diagram showing component risk evaluation point information 800 for each node of FIG. 7 assigned to the above processing. The component risk evaluation point information 800 is an example in which the element number 810 that uniquely identifies each node, that is, the component of the system, and the component risk evaluation point 820 of each node are associated with each other.

Next, the process returns to FIG. 5 and the description of steps S503 and subsequent steps is continued.

In step S503, the attack scenario calculation unit 103 sets a component for starting an attack and a component for the final target in the assumed attack scenario. For example, the attack scenario calculation unit 103 is set from each component selected in step S602. In this case, a possible combination of each selected component is set.

Then, in step S504, the attack scenario calculation unit 103 generates an attack scenario based on the topology shown in FIG. 7. As a result, the attack scenario calculation unit 103 defines the components that are the target of the attack from the component that starts the attack to the component that is the final target, the number of passing components that is the number, and the attack order. Generate multiple attack scenarios 900. Then, the attack scenario calculation unit 103 stores the attack scenario 900 in the attack scenario storage unit 104.

In this step S504, the attack scenario calculation unit 103 generates the attack scenario 900 according to a predetermined constraint condition. Constraints include so-called one-stroke writing that does not pass through each component more than once in the topology, and constraints indicating the scale such as a predetermined number of components. In particular, when the total value itself is used as the scenario risk evaluation point, it is desirable to align the number of components of the attack scenario 900 to be generated.

Here, an example of the generation result in step S504 will be described with reference to FIG. FIG. 9 is a diagram showing the generated attack scenario 900. The attack scenario 900 associates the scenario number 910 that uniquely identifies the scenario with the attack order 920 and the number of passing components 930.

In this embodiment, the attack scenario of step S504 is generated after the component risk degree calculation of step S502 is performed, but the order may be reversed. That is, step S503 is executed after step S501. Then, in step S504, the attack scenario calculation unit 103 generates an attack scenario. Then, in step S502, the component risk calculation unit 105 calculates the component risk of the components included in the generated attack scenario.

Next, in step S505, the risk sum total value calculation unit 106 assigns scenario risk evaluation points for each generated attack scenario 900. That is, in step S505, the division value calculation unit 107 calculates the scenario risk evaluation point.
Here, the detailed processing of step S505 will be described with reference to FIG.

FIG. 10 is a flow in which the risk level of each attack scenario 900 is evaluated and a scenario risk level evaluation point is given. First, in step S1001, the risk sum total value calculation unit 106 selects one of the attack scenarios 900 generated in step S504 for which the scenario risk evaluation point has not been assigned.

Then, in step S1002, the risk degree total value calculation unit 106 calculates the total value by summing up the component risk evaluation points for each component passing in the selected scenario. As described above, the calculation of the total value includes operations other than mere addition.

Then, in step S1003, the division value calculation unit 107 divides the total value by the number of passing components 930. This division makes it possible to reflect the efficiency of the attack in the evaluation. In other words, it is possible to evaluate the degree of risk per passage component for each attack scenario. As described above, various modifications can be considered for this division process.

Next, in step S1004, the division value calculation unit 107 assigns the division value in step S1003 to the scenario selected in step S1001 as a scenario risk evaluation point. That is, the division value calculation unit 107 stores the scenario risk evaluation point information 1100 shown in FIG. 11 in the storage device.

Then, in step S1005, the division value calculation unit 107 determines whether or not the scenario risk evaluation points have been given to the attack scenario 900 generated in step S504. As a result, if it is not given to all the attack scenarios 900 (step S1005: No), the process proceeds to step S1001 to give it to the remaining attack scenarios 900. On the other hand, when the scenario risk evaluation points are given to all the attack scenarios 900 (step S1005: Yes), the scenario risk evaluation points are given.

FIG. 11 is a diagram showing scenario risk evaluation point information 1100 given in step S505 with respect to the attack scenario 900 shown in FIG. The scenario risk evaluation point information 1100 is a total value 1130 and a scenario risk evaluation point (divided value) of the component risk evaluation points of each component of the scenario number 1110, the attack order 1120, and the attack order 1120 that uniquely identify the scenario. ) 1140 is the associated information.

Next, returning to FIG. 5, step S506 will be described. In step S506, the display unit 108 displays a list of scenario risk evaluation points. FIG. 12 shows a display example 1200 of the risk evaluation result including the scenario risk evaluation points for each attack scenario. The display example 1200 of this risk assessment result includes Table 1250. Then, Table 1250 associates the scenario number 1210, the attack order 1220, the total value 1230, and the scenario risk evaluation point (division value) 1240. It also includes a sort button 1201 that sorts the display contents of Table 1250 by scenario number 1210, attack order 1220, total value 1230, and scenario risk evaluation point (division value) 1240.

Further, it has a display range switching button 1202 that changes the display contents of Table 1250 with the scenario number 1210, the attack order 1220, the total value 1230, and the scenario risk evaluation point (division value) 1240. It also has a file output button 1203 that outputs the display 1250 as a file. In the example of FIG. 12, the scenario risk evaluation points (divided values) are sorted in descending order, and the display range is changed to the scenario risk evaluation points (divided values) of 6.5 or more. As the display contents, those having a scenario risk evaluation point of a predetermined value or more may be selectively displayed, or may be displayed in combination with the above-mentioned example.

This completes the description of this embodiment. According to the cyber risk assessment of this embodiment, the high possibility that an attack on the process will be launched is evaluated by using the total value of the component risk assessment points, and the attack is divided by the number of passing components. Evaluate efficiency. Therefore, it is possible to evaluate the risk of an attack scenario based on the behavioral habits of the attacker.

Hereinafter, Example 2 of the present invention will be described with reference to the drawings.

This embodiment is different in that the vulnerability information storage unit 1302 is used instead of the cyber attack method storage unit 102 of the risk assessment device of FIG. 1 described in the first embodiment. FIG. 13 shows a functional block diagram of the risk assessment device for the attack scenario of the second embodiment. In FIG. 13, reference numerals 101 and 103 to 108 are the same as those in FIG. Therefore, in this embodiment, in addition to the vulnerability information storage unit 1302, the method for calculating the component risk evaluation point in the component risk calculation unit 105 using the vulnerability information 1400 of the vulnerability information storage unit 1302 is used. Different from Example 1. Therefore, the system configuration in which the functional configuration shown in FIG. 13 is realized by a computer can be realized in FIG. 19 as in the first embodiment. Here, unlike the first embodiment, the attack content information is unnecessary in the second embodiment.

FIG. 14 is a diagram showing an example of vulnerability information 1400. Vulnerability information 1400 is information in which a vulnerability type 1410, a vulnerability number 1420, a vulnerability 1430, and a vulnerability risk level 1440 are associated with each other. The vulnerability type 1410 is a type of vulnerability, and in the case of the example shown in FIG. 14, there are a buffer error, SQO injection, and certificate / password management. The vulnerability number 1420 is a number for uniquely identifying the vulnerability. Vulnerability 1430 represents the name of the vulnerability. The risk level 1440 represents the risk level of each vulnerability and is set by using CVSS (Common Vulnerability Scoring System) or the like.
Since the overall flow of the risk assessment method in the present embodiment is the same as that shown in FIG. 5 shown in the first embodiment, the description thereof will be omitted. However, since the processing of step S502 in FIG. 5 is different, it will be described with reference to FIG.

FIG. 15 shows an example of a flowchart for explaining the assignment of the component risk evaluation points in step S502 in this embodiment. That is, this figure is a flowchart corresponding to FIG. 6 of the first embodiment.

First, in step S1501, the component risk calculation unit 105 reads the vulnerability information 1400 from the vulnerability information storage unit 1302.

Then, in step S1502, the component risk calculation unit 105 selects a component to which the component risk evaluation point is given from the components constituting the system to be attacked. That is, in this step, the same processing as in step S602 is executed.

Then, in step S1503, the component risk calculation unit 105 adds up the risk risk 1440 of the selected component for each component. For this purpose, the component risk calculation unit 105 identifies the vulnerability of each component. An example of this particular is shown below. The component risk calculation unit 105 uses the history information regarding the vulnerability of each component stored in advance. The history information is information that records the vulnerability 1430 caused by each component. The component risk calculation unit 105 adds up the risk 1440 indicated by the vulnerability indicated by the history information for each component. As in the case of the first embodiment, the summation includes operations other than addition.

Next, in step S1504, the component risk calculation unit 105 assigns the total value, which is the result of the sum in step S1503, as the component risk evaluation point of the selected component. That is, the component risk calculation unit 105 stores the component risk evaluation point information 1600 including the component risk evaluation points in the storage device.

Then, in step S1505, the component risk calculation unit 105 determines whether or not the component risk evaluation points have been given to all the components. That is, the component risk calculation unit 105 executes the same processing as in step S604 of FIG. When it is determined that all the items, that is, the component risk evaluation points are not given to each component (step S1505: No), the process proceeds to step S1501 to give to the next component. On the other hand, when it is determined that the component risk evaluation points have been given to all the components (step S1505: Yes), the addition of the component risk evaluation points ends.

FIG. 16 shows an example of each node of FIG. 7 in this embodiment, that is, the component risk evaluation point information 1600 for each component. The component risk evaluation point information 1600 shown in FIG. 16 includes a component number 1610 that uniquely identifies each node, that is, a component, a vulnerability number 1620 possessed by each node, and a component risk evaluation point of each node. It is the information associated with 1630.

In addition, by using the component risk evaluation points 1630, assigning the scenario risk evaluation points of each attack scenario in step S505, and displaying the scenario risk evaluation points of the attack scenario in step S506, the danger of this embodiment is displayed. The degree evaluation is completed.

Hereinafter, Example 3 of the present invention will be described with reference to the drawings.

In this embodiment, the generated contents of step S504 in FIG. 5 are different from those in the first embodiment. Therefore, step S504 and step S505 using the result of step S504 are different between the first embodiment and the present embodiment. Since other parts are the same as those in FIG. 5 shown in the first embodiment including the functional block diagram, the description thereof will be omitted.

FIG. 17 is a diagram showing an example of the attack scenario 1700 which is the generation result of step S504 in this embodiment. The attack scenario 1700 is information that associates the scenario number 1710 that uniquely identifies the scenario with the attack order 1720 and the number of component transitions 1730. The difference from the attack scenario 900 in FIG. 9 is that the number of component transitions 1730 is used instead of the number of passing components 930. Here, the component transition number 1730 of this embodiment is information indicating the number of times the corresponding attack scenario has transitioned to the component in the attack order 1720. Normally, the number of component transitions is a value obtained by subtracting 1 from the number of passing components.

Next, steps S504 and S505 in this embodiment will be described. First, in step S504, the attack scenario calculation unit 103 creates an attack scenario 1700 based on the topology shown in FIG. 7. At this time, as described above, the attack scenario calculation unit 103 specifies the number of component transitions 1730 instead of the number of passing components 930.

Next, the detailed processing of step S505 will be described with reference to FIG. FIG. 18 is a flowchart showing a flow for assigning a scenario risk evaluation point in this embodiment. That is, it corresponds to FIG. 10 of the first embodiment.

First, in step S1001, the risk sum total value calculation unit 106 selects one scenario for which the scenario risk evaluation point has not been assigned from the scenarios generated in step S504. That is, in step S1801, the same processing as in step S1001 is performed.

Then, in step S1802, the risk sum total value calculation unit 106 sums the component risk evaluation points for each component included in the attack order in the selected scenario. This step S1802 is the same process as step S1002.

Then, in step S1803, the division value calculation unit 107 divides the total value by the number of component transitions of 1703. This division makes it possible to reflect the efficiency of the attack in the evaluation. The process of step S1803 differs from step S1003 in what is used for division. Therefore, in the process of step S1803, various modification examples can be used as in step S1001.

Next, in step S1804, the division value calculation unit 107 assigns the division value in step S1803 to the scenario selected in step S1801 as a scenario risk evaluation point. That is, the division value calculation unit 107 stores the scenario risk evaluation point information 1100 as shown in FIG. 11 in the storage device. That is, step S1804 executes the same process as step S1004.

Then, in step S1805, the division value calculation unit 107 determines whether or not the scenario risk evaluation points have been given to the attack scenario 1700 generated in step S504. As a result, if it is not given to all the attack scenarios 1700 (step S1805: No), the process proceeds to step S1001 to give it to the remaining attack scenarios 1700. On the other hand, when the scenario risk evaluation points are given to all the attack scenarios 1700 (step S1805: Yes), the scenario risk evaluation points are given. According to this flow, a scenario risk evaluation point is given to each attack scenario, and the scenario risk evaluation point is displayed in step S506 to complete the risk evaluation of the present embodiment. That is, the same process as in FIG. 10 is executed in step S1805 and subsequent steps.

This is the end of the description of the embodiment of the present invention. The present invention is not limited to the above-described embodiment, and includes various modifications. The above embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner. Therefore, for example, all the configurations and processes described above, such as the content of the information stored in each storage unit, the process of assigning the component risk evaluation points for each component, the extraction result of the attack scenario, the evaluation result, etc. It is not limited to information and numerical values.

Further, each of the above configurations, functions, processing units, processing means and the like may be realized by hardware by designing a part or all of them by, for example, an integrated circuit. Further, each of the above configurations, functions, and the like may be realized by software by the processing unit 11 interpreting and executing a program that realizes each function as shown in FIG. Information such as programs, tables, and files that realize each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

101 ... System configuration storage unit 102 ... Cyber attack method storage unit 103 ... Attack scenario calculation unit 104 ... Attack scenario storage unit 105 ... Component risk degree calculation unit 106 ... Danger level total value calculation unit 107 ... Division value calculation unit 108 ... Display Part 200 ... System configuration information 300 ... Attack content information 800 ... Component risk evaluation point information 900 ... Attack scenario 1100 ... Scenario risk evaluation point information 1200 ... Risk evaluation result display example

Claims (10)

In an attack scenario risk assessment device for assessing the risk of a server attack scenario against a system consisting of multiple components
A system configuration information storage unit that stores system configuration information indicating the system configuration, and a system configuration information storage unit.
An attack scenario calculation unit that generates an attack scenario of a cyber attack indicating an attack order including at least a part of the plurality of components by using the system configuration information.
A risk total value calculation unit that calculates a total risk value by adding up the component risk evaluation points indicating the risk level of each component included in the generated attack scenario for each attack scenario.
A risk evaluation device for an attack scenario, which comprises a scenario risk evaluation point calculation unit that calculates a scenario risk evaluation point indicating the risk for each scenario based on the total risk value. In the risk assessment device for the attack scenario according to claim 1,
The scenario risk evaluation point calculation unit is a division value calculation unit that divides the total risk value by the number of components included in the attack order of the corresponding attack scenario. Evaluation device. In the risk assessment device for the attack scenario according to claim 1,
The scenario risk evaluation point calculation unit is a division value calculation unit that divides the risk total value by the number of component transitions included in the attack order of the corresponding attack scenario. Degree evaluation device. In the attack scenario risk assessment device according to any one of claims 1 to 3.
The attack scenario calculation unit extracts components to be attacked from the plurality of components constituting the system, and defines the attack order for the extracted components and the number of components included in the attack order. An attack scenario risk assessment device characterized by generating multiple attack scenarios. In the risk assessment device for the attack scenario according to claim 4,
The attack scenario calculation unit is a risk assessment device for an attack scenario, characterized in that the extraction of the components is executed according to a predetermined constraint condition relating to the scale. In the risk assessment device for the attack scenario according to claim 1,
Further, it has a component risk calculation unit for calculating the component risk evaluation points of the components included in the generated attack scenario.
The component risk calculation unit determines the component risk evaluation points by using the information indicating the countermeasure status against the server attack for each type of the attack scenario defined for each component included in the system. A risk assessment device for attack scenarios characterized by calculation. In the risk assessment device for the attack scenario according to claim 1,
Further, it has a component risk calculation unit for calculating the component risk evaluation points of the components included in the generated attack scenario.
The component risk calculation unit calculates the risk evaluation of the component risk using the information indicating the vulnerability defined for each component included in the system. Device. In the attack scenario risk assessment method for assessing the risk of a server attack scenario against a system consisting of multiple components
The system configuration information indicating the configuration of the system is stored in the system configuration information storage unit.
Using the system configuration information, an attack scenario of a cyber attack showing an attack order including at least a part of the plurality of components is generated.
The component risk evaluation points indicating the risk level of each component included in the generated attack scenario are added up for each attack scenario to calculate the total risk level value.
A risk evaluation method for an attack scenario, which comprises calculating a scenario risk evaluation point indicating a risk for each scenario based on the total risk value. In the attack scenario risk assessment method according to claim 8,
The scenario risk evaluation point is based on the total risk value. A risk assessment method for an attack scenario, characterized in that it is calculated by dividing by the number of components included in the attack order of the corresponding attack scenario. In the attack scenario risk assessment method according to claim 8,
A risk evaluation method for an attack scenario, which is calculated by dividing the scenario risk evaluation point by the total number of risk levels by the number of component transitions included in the attack order of the corresponding attack scenario. ..

Images