JP6552135B1 - Exercise control program for cyber attacks - Google Patents

Abstract

The present invention provides a program capable of performing an exercise in accordance with a skill level of a person to be exercised in an exercise against a cyber attack. A program for causing a computer to execute an exercise for a cyber attack using a system including a plurality of information processing devices is deployed in each of the plurality of information processing devices and executes a process according to a given attack scenario. For each, the computer is caused to execute a process of transmitting a control signal for controlling a cyber attack to be executed based on the attack scenario. [Selection] Figure 1

Description

  Embodiments described herein relate generally to a program.

  Conventionally, exercises for cyber attacks are performed using a simulated exercise system that serves as an exercise ground. In this exercise system, a virus that actually performs a cyber attack, for example, by infecting with a virus, is injected into the information processing apparatus. Then, the exercise target person operates the terminal device to practice dealing with the cyber attack by the virus injected into the information processing apparatus.

Special table 2014-506045 gazette International Publication No. 2015/029195 JP 2013-149063 A

  However, in the above-described conventional technology, the cyber attack at the time of the exercise is left to the virus injected into the information processing apparatus, so that the cyber attack may not be performed according to the planned scenario. For this reason, there is a problem that it is difficult to carry out an exercise that intentionally conducts a cyber attack having a content that matches the skill level of the exercise subject and causes the exercise subject to cope with it.

  Moreover, it aims at providing the program which can implement the exercise | movement according to the skill level of the exercise subject in the exercise | movement with respect to a cyber attack in one side.

  In the first plan, the program causes a computer to execute a cyber attack on a system including a plurality of information processing apparatuses. In addition, the program is installed in each of a plurality of information processing apparatuses, and transmits a control signal for controlling a cyber attack to be executed based on the attack scenario to each of the programs that execute processing according to the given attack scenario. Cause the computer to execute the process.

  According to one embodiment of the present invention, it is possible to carry out an exercise according to the skill level of the exercise subject in an exercise against a cyber attack.

FIG. 1 is an explanatory diagram illustrating an exercise system according to an embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the exercise system according to the embodiment. FIG. 3 is a flowchart illustrating an operation example of the exercise system according to the embodiment. FIG. 4 is an explanatory diagram for explaining an attack scenario (whole). FIG. 5 is an explanatory diagram for explaining an attack scenario (part). FIG. 6 is an explanatory diagram illustrating an attack history in the attack result log (part). FIG. 7 is an explanatory diagram for explaining a scenario to be dealt with. FIG. 8 is an explanatory diagram illustrating an operation history in the operation result log (part). FIG. 9 is a block diagram illustrating an example of the hardware configuration of the management device, the information processing device, and the terminal device according to the embodiment.

  Hereinafter, a program according to an embodiment will be described with reference to the drawings. In the embodiment, configurations having the same functions are denoted by the same reference numerals, and redundant description is omitted. Note that the programs described in the following embodiments are merely examples, and do not limit the embodiments. In addition, each of the following embodiments may be appropriately combined within the scope of no contradiction.

  FIG. 1 is an explanatory diagram illustrating an exercise system 100 according to the embodiment. As shown in FIG. 1, the exercise system 100 includes a management device 1, information processing devices 2A, 2B, 2C, and so on, and terminal devices 3A, 3B, and so on. For example, a computer such as a PC (personal computer), a workstation, and a server can be applied to the management device 1, the information processing devices 2A, 2B, 2C,... And the terminal devices 3A, 3B,.

  The management device 1 manages the cyber attacks AT1, AT2 of the information processing devices 2A, 2B, 2C. The information processing devices 2A, 2B, 2C,... Are server devices that provide various services to the terminal devices 3A, 3B, etc., such as file servers, mail servers, Web servers, and the like. Cyber attacks AT1 and AT2 are implemented. The terminal devices 3A, 3B... Are used by general users who use various services provided by the information processing devices 2A, 2B, 2C. Terminal.

  The number of the information processing devices 2A, 2B, 2C,... May be one or more, and the number is not limited. Similarly, the number of terminal devices 3A, 3B,... May be one or more, and the number is not limited. The information processing devices 2A, 2B, 2C,... Are referred to as the information processing device 2 unless otherwise specified. Similarly, the terminal devices 3A, 3B,... Will be referred to as the terminal device 3 unless otherwise specified. Also, the internal configurations of the information processing devices 2A, 2B, 2C, and the terminal devices 3A, 3B, and so on are referred to by omitting “A”, “B”, “C”. .

  The information processing device 2 and the terminal device 3 are connected to be communicable with each other via a communication network N1 such as a LAN (Local Area Network). In addition, the management apparatus 1 and the information processing apparatus 2 are connected to be communicable with each other via a communication network N2 such as a LAN. The communication network N1 and the communication network N2 are separately configured by a VLAN (Virtual LAN) or the like. As described above, in the exercise system 100, the communication network N1 when the terminal device 3 copes with the cyber attacks AT1 and AT2 in the information processing device 2 and the cyber attacks AT1 and AT2 in the information processing device 2 from the management device 1. The communication network N2 for management may be different networks so as not to affect each other.

  The management device 1 includes a cyber attack control unit 101 and a scenario management unit 104. The scenario management unit 104 manages the attack scenario (whole) 111 and the planned scenario 114. The attack scenario (overall) 111 is data in which the scenario of the entire cyber attacks AT1 and AT2 of the information processing devices 2A, 2B, 2C... And the terminal devices 3A, 3B. The cyber attack control unit 101 reads the attack scenario (entire) 111 managed by the scenario management unit 104 and creates attack scenarios (parts) 211A, 211B, 211C,... For each of the information processing apparatuses 2A, 2B, 2C,. ,Send. Are transmitted to each of the terminal devices 3A, 3B,... Based on the attack scenario (whole) 111. The attack scenario (overall) 111 can be updated as appropriate according to the skill level that is the ability of the exercise subject to cope with the cyber attacks AT1 and AT2.

  In the information processing apparatuses 2A, 2B, 2C..., Agents (children) according to attack scenarios (parts) 211A, 211B, 211C... ) 202A, 202B, 202C... Are generated. The agents (children) 202A, 202B, 202C,... Are virus entities obtained by processing of programs that perform various cyber attacks.

  For example, in the information processing apparatus 2A, the agent (child) 202A is generated according to the attack scenario (part) 211A transmitted from the management apparatus 1 by the processing by the agent (parent) 201A. The agent (child) 202A is generated in response to the contents (attack type) of the attack scenario (part) 211A, and externally such as an internal cyber attack AT1 such as data modification or a DoS attack (Denial of Service attack) Perform cyber attack AT2.

  The agents (parents) 201A, 201B, 201C,... Monitor the processes of the information processing apparatuses 2A, 2B, 2C, etc., and the attack histories of the agents (children) 202A, 202B, 202C,. , 212C... Agents (operations) 203A, 203B, 203C,..., Which are resident programs similar to the agents (parents) 201A, 201B, 201C,... Record as 213B, 213C,.

  The terminal devices 3A, 3B,... Perform the same processing as the information processing devices 2A, 2B, 2C,. Specifically, agents (children) 302A, 302B,... Are generated according to attack scenarios (parts) 311A, 311B,... By processing of agents (parents) 301A, 301B,. The agents (children) 302A, 302B,... Are virus entities resulting from the processing of programs that implement various cyber attacks.

  The agent (parent) 301A, 301B... Monitors the processes of the terminal devices 3A, 3B... And records the attack history of the agent (child) 302A, 302B. Agents (operations) 303A, 303B,..., Which are resident programs similar to the agents (parents) 301A, 301B,... Record operation histories handled by the exercise target person as logons as operation result logs (parts) 313A, 313B,. Then, it collects in the management apparatus 1 via the communication network N2, and creates the operation result log (whole) 113.

  The management device 1 uses the attack result logs (parts) 212A, 212B, 212C,... Recorded in the information processing devices 2A, 2B, 2C... And the attack result logs (parts) 312A, 312B recorded in the terminal devices 3A, 3B. Are collected via the communication network N2, and an attack result log (whole) 112 is created. In addition, regarding the countermeasure operation for the cyber attack, the operation content assumed for each cyber attack of the attack scenario (entire) 111 is predetermined as the countermeasure scheduled scenario 114. By the attack result log (whole) 112, the operation result log (whole) 113, and the scheduled action scenario 114, the exercise supervisor of the management apparatus 1 can confirm the exercise status of the exercise subject.

  FIG. 2 is a block diagram illustrating a functional configuration of the exercise system 100 according to the embodiment. As illustrated in FIG. 2, the management device 1 includes a control unit 10, a storage unit 11, a communication unit 12, a display unit 13, and an operation unit 14.

  The control unit 10 has an internal memory for storing various programs and control data, and executes various processes by these. In one embodiment, the control unit 10 is implemented as a central processing unit, so-called CPU (Central Processing Unit). In addition, the control part 10 does not necessarily need to be mounted as a central processing unit, and may be mounted as a MPU (Micro Processing Unit). The control unit 10 can also be realized by hard wired logic such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

  The storage unit 11 is a storage device that stores various programs executed by the control unit 10 and data used for the various programs. As one embodiment, the storage unit 11 is implemented as a main storage device in the apparatus. For example, various storage devices such as RAM (Random Access Memory) or flash memory can be adopted as the storage unit 11. The storage unit 11 can also be implemented as an auxiliary storage device. In this case, a hard disk drive (HDD), an optical disk, a solid state drive (SSD), or the like can be employed. For example, the storage unit 11 stores an attack scenario (overall) 111 and an attack result log (overall) 112.

  The communication unit 12 is an interface which communicates with another device (for example, the information processing device 2) connected via the communication network N2 under the control of the control unit 10. The display unit 13 is a display device such as an LCD (Liquid Crystal Display) and performs display under control of the control unit 10. The operation unit 14 is an input device such as a keyboard, a mouse, and a touch panel, and receives an operation from a user (for example, a monitor of an exercise) and outputs the operation to the control unit 10.

  The information processing apparatus 2 includes a control unit 20, a storage unit 21, and a communication unit 22. The control unit 20 executes various processes according to various programs and control data. As one embodiment, the control unit 20 is implemented as a central processing unit, a so-called CPU.

  The storage unit 21 is a storage device that stores various programs executed by the control unit 20 and data used for the various programs. As one embodiment, the storage unit 21 is implemented as a main storage device in the apparatus. For example, the storage unit 21 can employ various semiconductor memory elements such as RAM and flash memory. The storage unit 21 can also be implemented as an auxiliary storage device. In this case, an HDD, an optical disk, an SSD, or the like can be employed. For example, the storage unit 21 stores an attack scenario (part) 211 and an attack result log (part) 212.

  The communication unit 22 is an interface that performs communication with other devices (for example, the management device 1 and the terminal device 3) connected via the communication network N1 and the communication network N2 under the control of the control unit 20.

  The terminal device 3 includes a control unit 30, a storage unit 31, and a communication unit 32. The control unit 30 executes various processes according to various programs and control data. As one embodiment, the control unit 30 is implemented as a central processing unit, a so-called CPU.

  The storage unit 31 is a storage device that stores various programs executed by the control unit 30 and data used for the various programs. As one embodiment, the storage unit 31 is implemented as a main storage device in the apparatus. For example, the storage unit 31 can employ various semiconductor memory elements such as RAM and flash memory. The storage unit 31 can also be implemented as an auxiliary storage device. In this case, an HDD, an optical disk, an SSD, or the like can be employed. For example, the storage unit 31 stores an attack scenario (part) 311 and an attack result log (part) 312.

  The communication unit 32 is an interface that performs communication with other devices (for example, the management device 1 and the terminal device 3) connected via the communication network N1 and the communication network N2 under the control of the control unit 30.

  The control unit 10 implements the functions of the cyber attack control unit 101, the log collection unit 102, the display control unit 103, and the scenario management unit 104 by executing a program. Further, the control unit 20 and the control unit 30 execute functions of the agent (parent) 201, agent (child) 202, agent (parent) 301, and agent (child) 302 by executing a program.

  The cyber attack control unit 101 reads the attack scenario (whole) 111 stored in the storage unit 11 and controls the cyber attack against the information processing apparatus 2 to be attacked based on the attack scenario (whole) 111 (Part) 211 is transmitted as a control signal via the communication unit 12. Specifically, a description corresponding to each of the information processing apparatuses 2 (2A, 2B, 2C,...) Is extracted from the scenario of the entire exercise system 100 described in the attack scenario (entire) 111, and the attack scenario (partial). ) 211 (211A, 211B, 211C...) To the information processing apparatus 2. Further, a description corresponding to each of the terminal devices 3 (3A, 3B,...) Is extracted from the scenario of the entire exercise system 100 described in the attack scenario (total) 111, and the attack scenario (part) 311 (311A, 311B) is extracted. ...) is transmitted to the terminal device 3.

  From each of the information processing devices 2 (2A, 2B, 2C,...), The log collection unit 102 receives an attack result log (part) 212 recorded in the storage unit 21 and each of the terminal devices 3 (3A, 3B,...) The attack result log (part) 312 recorded in the storage unit 31 is collected via the communication unit 12. Specifically, the log collection unit 102 requests the agent (parent) 201 of the information processing device 2 to request an attack result log (part) 212 and the attack result to the agent (parent) 301 of the terminal device 3. A command requesting the log (part) 312 is transmitted via the communication unit 12. The agent (parent) 201 reads the attack result log (part) 212 from the storage unit 21 in response to a command requesting the attack result log (part) 212 from the management apparatus 1 and transmits it to the management apparatus 1. Further, the agent (parent) 301 reads the attack result log (part) 312 from the storage unit 31 in response to a command requesting the attack result log (part) 312 from the management apparatus 1 and transmits it to the management apparatus 1. The log collection unit 102 includes an attack scenario (part) 211 transmitted from each of the information processing apparatuses 2 (2A, 2B, 2C...) And an attack scenario (partial) transmitted from each of the terminal apparatuses 3 (3A, 3B...). ) 311 are merged, and the attack result log (whole) 112 of the entire exercise system 100 is stored in the storage unit 11.

  The display control unit 103 performs display control on the display screen of the display unit 13. For example, the display control unit 103 displays graphics such as icons and buttons in a GUI (Graphical User Interface) on the display screen of the display unit 13. The control unit 10 receives an operation instruction from the operation unit 14 in the GUI displayed on the display unit 13 and displays the processing result corresponding to the operation on the display screen.

  As an example, the display control unit 103 causes the display unit 13 to display a display screen for creating the attack scenario (whole) 111. The control unit 10 receives an operation instruction from the operation unit 14 on the display screen displayed on the display unit 13, creates an attack scenario (whole) 111, and registers the created attack scenario (whole) 111 in the storage unit 11. Further, the display control unit 103 reads the attack result log (entire) 112 from the storage unit 11 and displays it on the display screen of the display unit 13 as a training situation in the exercise system 100.

  The scenario management unit 104 manages the attack scenario (whole) 111 and the planned scenario 114. The attack scenario (whole) 111 is data that sequentially describes cyber attacks in the exercise system 100 after the exercise starts. The scheduled handling scenario 114 is data in which the operation content (coping operation) assumed for each cyber attack of the attack scenario (whole) 111 is described.

  The agent (parent) 201 causes the storage unit 21 to store the attack scenario (portion) 211 transmitted from the management device 1. Furthermore, the agent (parent) 201 generates an agent (child) 202 that implements a cyber attack based on the attack scenario (part) 211 transmitted from the management device 1. Specifically, the agent (parent) 201 generates the agent (child) 202 at the timing of starting the cyber attack described in the attack scenario (part) 211. The agent (child) 202 carries out a cyber attack of the content described in the attack scenario (part) 211 based on the attack scenario (part) 211.

  The agent (parent) 201 is a process that is processed in the background, for example, like a cron daemon that performs schedule management for executing commands on a regular basis. This agent (parent) 201 generates an agent (child) 202 that actually acts as a virus, but is not subject to virus removal (activity stop) by the exercise subject. On the other hand, since the agent (child) 202 actually acts as a virus, it becomes a target of virus removal by the exercise subject during a cyber attack. Therefore, in the information processing apparatus 2, a cyber attack is performed according to the attack scenario (part) 211.

  The agent (parent) 201 monitors a process or the like in the information processing apparatus 2 and uses the success / failure of the cyber attack of the agent (child) 202 based on the attack scenario (part) 211 as an attack history log (part) 212. To record. In addition, the agent (operation) 203 operates as an operation history with the operation content that the subject person logged on from the terminal device 3 responds to the cyber attack of the agent (child) 202 based on the attack scenario (part) 211 as an operation history. Record in the log (part) 213. The agent (parent) 201 reads the attack result log (part) 212 recorded in response to the request from the management device 1 from the storage unit 21 and transmits it to the management device 1 via the communication unit 22, and the agent (operation) An operation result log (part) 213 recorded in response to a request from the management apparatus 1 is read from the storage unit 21 and transmitted to the management apparatus 1 via the communication unit 22.

  The agent (parent) 301 causes the storage unit 31 to store the attack scenario (part) 311 transmitted from the management device 1. In addition, the agent (parent) 301 generates an agent (child) 302 that performs a cyber attack based on the attack scenario (part) 311 transmitted from the management apparatus 1. Specifically, the agent (parent) 301 generates the agent (child) 302 at the timing of starting the cyber attack described in the attack scenario (part) 311. Based on the attack scenario (part) 311, the agent (child) 302 executes a cyber attack having the contents described in the attack scenario (part) 311.

  The agent (parent) 301 is a process that is processed in the background in the same manner as, for example, a coulomb daemon that performs schedule management for executing commands on a regular basis. This agent (parent) 301 generates an agent (child) 302 that actually acts as a virus, but is not subject to virus removal (activity stop) by the exercise subject. On the other hand, since the agent (child) 302 actually acts as a virus, it becomes a target of virus removal by the exercise subject during a cyber attack. Therefore, in the terminal device 3, a cyber attack is performed according to the attack scenario (part) 311.

  The agent (parent) 301 monitors a process or the like in the terminal device 3 and stores the success / failure of the cyber attack of the agent (child) 302 based on the attack scenario (part) 311 in the attack result log (part) 312 as an attack history. Record. The agent (parent) 301 reads the attack result log (part) 312 recorded in response to the request from the management device 1 from the storage unit 31 and transmits it to the management device 1 via the communication unit 32, and the agent (operation) An operation result log (part) 313 recorded in response to a request from the management apparatus 1 is read from the storage unit 31 and transmitted to the management apparatus 1 via the communication unit 32.

  FIG. 3 is a flowchart illustrating an operation example of the exercise system 100 according to the embodiment. As shown in FIG. 3, the management device 1 displays a display screen for creating an attack scenario (entire) 111 on the display unit 13 and receives an operation instruction from the operation unit 14 under the control of the control unit 10. Thus, an attack scenario (whole) 111 is created (S1). Next, the control unit 10 registers the created attack scenario (entire) 111 in the storage unit 11 (S2).

  FIG. 4 is an explanatory diagram for explaining the attack scenario (entire) 111. As shown in FIG. 4, the attack scenario (whole) 111 is data in which cyber attacks in the exercise system 100 after the start of the exercise are sequentially described. Specifically, the attack scenario (entire) 111 includes “attack type”, “start time”, “end time”, “attack source”, “attack” for each cyber attack numbered “No.”. Data in which parameters such as “destination” and “supplement parameter” are described.

  The “attack type” indicates the type of cyber attack such as “portable storage medium intrusion”, “direct diffusion”, “stealthization”, “traffic transmission”, “file tampering” and the like. The “start time” and “end time” indicate the time to start a cyber attack and the time to end a cyber attack after the start of the exercise. For example, by shortening the time interval of “start time” in each cyber attack, the attack speed of the cyber attack is increased. Conversely, by increasing the time between “start times” in each cyber attack, the attack speed of the cyber attack is slowed down.

  For “attack source” and “attack destination”, information indicating attack routes such as the device that is the source of cyber attack and the device that is the attack destination (for example, host name or network address such as “device A” or “device B”) Is shown. The “supplementary parameter” indicates a value that supplements the content of the cyber attack. Specifically, the "supplementary parameter" indicates the value of the cyber attack magnitude. For example, the size of the cyber attack indicates the size of the resource occupied by the cyber attack, and may be the processing load condition in the cyber attack. As an example, if the size of a cyber attack is large and more resources are occupied compared to normal processing, it is considered as "high load". Conversely, if the size of the cyber attack is small and resource occupancy is small compared to normal processing, "low load" is used.

  In the creation of the attack scenario (overall) 111 in S1, parameters are set according to the skill level of the person being trained. For example, if the skill level of the subject is not high and it takes time to deal with cyber attacks, parameters such as attack speed and attack size should be lowered. As an example, as shown in FIG. 4, when the skill level of the target person is low, the “start time” interval between each cyber attack is lengthened, and the attack speed is lower than the original attack scenario (total) 111. Attack scenario (whole) 111A. Similarly, in the attack scenario (overall) 111A, the “supplemental parameter” indicating the attack scale is changed from “high load” in which the attack scale increases to “low load” in which the attack scale decreases. As a result, a cyber attack tailored to the skill level of the target person is implemented.

  The creation and registration of the attack scenario (overall) 111 in S1 and S2 may be performed during the exercises after S3. Specifically, during the exercise, the processing of S1 and S2 is performed, so that the attack scenario (whole) 111 registered before the exercise is changed. When this attack scenario (whole) 111 is changed, an attack scenario (part) 211 based on the changed attack scenario (whole) 111 is transmitted to each information processing apparatus 2 in S5 after S3. It becomes. In this way, the attack scenario (entire) 111 may be changed as appropriate in accordance with the training situation during the exercise.

  When the exercise is started after registering the attack scenario (total) 111 (S3), the cyber attack control unit 101 of the management apparatus 1 starts after the exercise is started in the cyber attack of the registered attack scenario (total) 111. It is determined whether or not there is a cyber attack at the time (S4).

  When there is a cyber attack with the start time (S4: YES), the cyber attack control unit 101 reads the parameters of the cyber attack with the start time from the attack scenario (whole) 111, and includes an attack scenario ( (Part) 211 is transmitted to the information processing apparatus 2 that is the attack source (S5). The agent (parent) 201 of the information processing device 2 stores the transmitted attack scenario (portion) 211 in the storage unit 21.

  The transmission of the attack scenario (part) 211 is not limited to the method of transmitting the attack scenario (partial) 111 to the attacking information processing apparatus 2 in order from the start of the cyber attack of the attack scenario (entire) 111. For example, even if the cyber attack control unit 101 classifies each cyber attack included in the attack scenario (whole) 111 at the start time of the exercise for each attack source, and simultaneously transmits them to each of the information processing apparatuses 2 that are the attack sources. Good.

  FIG. 5 is an explanatory diagram illustrating attack scenarios (parts) 211A to 211D. The attack scenarios (portions) 211A to 211D illustrated in FIG. 5 are ones in which the attack source is transmitted to each of “apparatus A” to “apparatus D”. As shown in FIG. 5, for the information processing apparatuses 2 of “apparatus A” to “apparatus D”, “attack type”, “start time”, “end time” based on the attack scenario (entire) 111 The attack scenarios (portions) 211A to 211D including the “attack target” and the “supplementary parameter” are transmitted.

  The agent (parent) 201 of the information processing apparatus 2 determines whether or not the cyber attack performed according to the parameters of the agent (parent) 201 is the first cyber attack after the exercise is started (S6). If it is the first cyber attack (S6: YES), the agent (parent) 201 generates an agent (child) 202 for performing the cyber attack (S7). Specifically, the agent (parent) 201 generates an agent (child) 202 corresponding to the “attack type”. Further, when it is not the first cyber attack (S6: NO), the agent (parent) 201 has already generated the agent (child) 202 for performing the cyber attack, and therefore skips the processing of S7.

  Next, the agent (child) 202 executes a cyber attack according to the parameters of the attack scenario (part) 211 (S8). For example, in the agent (child) 202A that performs a cyber attack based on the attack scenario (partial) 211A (see FIG. 5), the cyber attack “entry of portable storage medium” is started at “00:15:00”. Device A ", that is, the device itself. Further, the agent (child) 202A performs a “direct diffusion” cyber attack on “devices B, C, and D”, that is, other devices at the start time “00:30:30”.

  Next, the agent (parent) 201, based on the monitoring result of the process in the information processing apparatus 2, indicates the success / failure of the cyber attack of the agent (child) 202 based on the attack scenario (part) 211 (attack result log ( (Part) 212 is recorded (S9). For example, when processing by the cyber attack of the agent (child) 202 is executed according to the scenario described in the attack scenario (part) 211, it is determined that the cyber attack is successful. In addition, if the processing result according to the scenario described in the attack scenario (part) 211 is not obtained, or if the agent (child) 202 is killed (deactivate), it is determined that the cyber attack has failed.

  FIG. 6 is an explanatory diagram illustrating attack histories in the attack result logs (parts) 212A to 212D. The attack result logs (portions) 212A to 212D illustrated in FIG. 6 indicate attack result logs (portions) in each of the “device A” to “device D”. As shown in FIG. 6, in S9, attack histories corresponding to the attack scenarios (parts) 211A to 211D are recorded in the attack result logs (parts) 212A to 212D. For example, for each cyber attack, “attack result” indicating failure / success of the attack, “start time (result)” and “end time (result)” indicating the start and end times of the attack are recorded.

  Next, the agent (parent) 201 determines whether or not an exercise target person who has logged on to the information processing apparatus 2 performs an operation to cope with a cyber attack (S10). Regarding the countermeasure operation for this cyber attack, the operation content assumed for each cyber attack of the attack scenario (entire) 111 is predetermined as the scenario 114 to be countered. In S <b> 10, the agent (operation) 203 determines whether or not there is a handling operation according to the handling schedule scenario 114.

  FIG. 7 is an explanatory diagram for explaining the countermeasure schedule scenario 114. As shown in FIG. 7, in the countermeasure schedule scenario 114, operation contents such as “scheduled countermeasure type” and “response category” for each cyber attack are defined.

  In the “planned action type”, the type of operation for cyber attacks such as “error detection”, “network disconnection”, “process stop”, “file recovery”, etc. is defined. For example, "abnormality detection" indicates the execution of a predetermined survey command. Also, "network disconnection" indicates the execution of a command to stop the network function. “Process stop” indicates that the agent (child) 202 is stopped by the kill command. Also, "file recovery" indicates recovery of a tampered file by a recovery command.

  “Correction category” is a category (classification) of the countermeasure operation performed by the exercise subject, and includes “investigation”, “initial countermeasure”, “cause countermeasure”, “recovery”, and the like.

  When there is a response operation to the cyber attack (S10: YES), the agent (operation) 203 records an operation history indicating the response operation performed to the cyber attack in the operation result log (part) 213 (S11). . When there is no countermeasure operation against the cyber attack (S10: NO), the agent (operation) 203 skips the processing of S11.

  FIG. 8 is an explanatory diagram for explaining the operation history in the operation result logs (parts) 213E, 213B, and 213C. The operation result logs (parts) 213E, 213B, and 213C illustrated in FIG. 8 indicate operation result logs (parts) in each of “device E”, “device B”, and “device C”.

  As illustrated in FIG. 8, in S11, operation histories indicating operations to cope with cyber attacks of “device E”, “device B”, and “device C” are recorded in operation result logs (parts) 213E, 213B, and 213C. . For example, together with “scheduled response type” and “remedy category” of the scheduled response scenario for each cyber attack, “remedy device” indicating the device actually addressed, “remedial action” indicating the actual operation content, and operation time “Correction time” is recorded.

  The log collection unit 102 of the management device 1 collects the attack result log (part) 212 and the operation result log (part) 213 recorded in S9 and S11 from each information processing device 2 (S12), and the attack result log (entire) ) 112 and the operation result log (whole) 113 are recorded in the storage unit 11. Note that the log collection unit 102 may collect the attack result log (part) 212 and the operation result log (part) 213 from each information processing apparatus 2 in S12.

  The collection of the attack result log (part) 212 in S12 is not limited to the request from the log collection unit 102. For example, when there is an operation to cope with a cyber attack (S10: YES), the agent (operation) 203 may transmit an operation result log 213 (part) including an operation history of the coping operation to the management apparatus 1. Further, when a cyber attack is executed in S <b> 8, the agent (parent) 201 may transmit an attack result log 212 (part) including the attack history to the management apparatus 1.

  Next, the display control unit 103 of the management device 1 reads the attack result log (entire) 112 from the storage unit 11 and displays it on the display screen of the display unit 13 as an exercise status in the exercise system 100 (S13).

  Next, the cyber attack control unit 101 of the management device 1 determines whether or not the exercise has ended based on whether or not the current time has reached the end time in the attack scenario (whole) 111 (S14). If not completed (S14: NO), the cyber attack control unit 101 returns the process to S4. If it is the end (S14: YES), the cyber attack control unit 101 notifies the agent (parent) 201 of each information processing device 2 of the end and ends the exercise. The agent (parent) 201 notified of the termination stops the agent (child) 202 generated by itself and ends the processing.

  As described above, in the exercise system 100, the plurality of information processing apparatuses 2A, 2B, 2C,... Are provided with agents (children) 202A, 202B, and 202C that execute processing according to a given attack scenario. In the exercise system 100, the cyber attack control unit 101 of the management device 1 controls cyber attacks to be executed based on the attack scenario (whole) 111 for each of the agents (children) 202A, 202B, 202C. Attack scenarios (parts) 211A, 211B, 211C,..., Which are control signals to be transmitted. Therefore, in the exercise system 100, the cyber attack can be performed according to the planned attack scenario (total) 111, and the exercise according to the skill level of the exercise target person can be easily performed.

  It should be noted that each component of each illustrated apparatus does not necessarily have to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. It can be integrated and configured.

  Various processing functions performed by the management device 1, the information processing device 2, and the terminal device 3 are all or some of the functions performed on the CPU (or a microcomputer such as an MPU or MCU (Micro Controller Unit)). You may make it perform. In addition, various processing functions may be executed in whole or in any part on a program that is analyzed and executed by a CPU (or a microcomputer such as an MPU or MCU) or hardware based on wired logic. Good.

  The various processes described in the above embodiment can be realized by executing a prepared program on a computer. Therefore, in the following, an example of a computer (hardware) that executes a program having the same function as in the above embodiment will be described. FIG. 9 is a block diagram illustrating an example of a hardware configuration of the management device 1, the information processing device 2, and the terminal device 3 according to the embodiment. In the illustrated example, the configuration of the management device 1 is illustrated as an example, but the configurations of the information processing device 2 and the terminal device 3 are also the same.

  As illustrated in FIG. 9, the management device 1 includes a CPU 501 that executes various arithmetic processes, an input device 502 that receives data input, a monitor 503, and a speaker 504. In addition, the management apparatus 1 includes a medium reading device 505 that reads a program and the like from a storage medium, an interface device 506 for connecting to various devices, and a communication device 507 for communication connection with an external device by wire or wireless. . The management device 1 also includes a RAM 508 that temporarily stores various types of information and a hard disk device 509. Each unit (501 to 509) in the management apparatus 1 is connected to the bus 510.

  The hard disk device 509 stores a program 511 for executing various processes by the control unit 10 described in the above embodiment. Also, the hard disk device 509 stores various data 512 (attack scenario (overall) 111, attack result log (overall) 112, etc.) referred to by the program 511. The input device 502 receives, for example, an input of operation information from the operator of the management device 1. The monitor 503 displays, for example, various screens operated by the operator. For example, a printing device is connected to the interface device 506. The communication device 507 is connected to a communication network such as a LAN (Local Area Network), and exchanges various types of information with an external device via the communication network.

  The CPU 501 reads out the program 511 stored in the hard disk device 509, develops it in the RAM 508, and executes it to perform various processes. The program 511 may not be stored in the hard disk device 509. For example, the management apparatus 1 may read and execute the program 511 stored in a storage medium that can be read by the management apparatus 1. The storage medium that can be read by the management apparatus 1 is, for example, a portable storage medium such as a CD-ROM, a DVD disk, or a USB (Universal Serial Bus) memory, a semiconductor memory such as a flash memory, a hard disk drive, or the like. Alternatively, the program may be stored in a device connected to a public line, the Internet, a LAN, or the like, and the management device 1 may read and execute the program from these.

DESCRIPTION OF SYMBOLS 1 ... Management apparatus 2, 2A-2C ... Information processing apparatus 3, 3A, 3B ... Terminal device 10, 20, 30 ... Control part 11, 21, 31 ... Storage part 12, 22, 32 ... Communication part 13 ... Display part 14 ... Operation unit 100 ... Exercise system 101 ... Cyber attack control unit 102 ... Log collection unit 103 ... Display control unit 111, 111A ... Attack scenario (whole)
112 ... Attack result log (whole)
113 ... Operation result log (whole)
114: Measures to be taken scenario 201, 201A to C, 301, 301A, 301B: Agent (parent)
202, 202A-C, 302, 302A, 302B ... agent (child)
203, 203A-C, 303, 303A, 303B ... Agent (operation)
211, 211A-D, 311, 311A, 311B ... attack scenario (part)
212, 212A-E, 312, 312A, 312B ... Attack result log (partial)
213, 213B-C, 213E, 313, 313A, 313B ... Operation result log (part)
501 ... CPU
511 ... program 512 ... various data AT1, AT2 ... cyber attack N1, N2 ... communication network

Claims (10)

In a program that causes a computer to execute exercises against cyber attacks using a system including a plurality of information processing devices,
A control signal for controlling a cyber attack to be executed based on an attack scenario is transmitted to each of the plurality of information processing apparatuses or a program deployed in each of the plurality of information processing apparatuses or terminals and executing processing according to a given attack scenario. A program that causes a computer to execute a process. The cyber attack transmitted from the management device to the one or more information processing devices or one or more terminal devices of the specific information processing device in which the specific program is deployed. The program according to claim 1, wherein the signal is a signal that controls the program. The program according to claim 1, wherein the attack scenario includes parameters of an attack path, an attack speed, an attack time, and an attack size. The program according to claim 3, wherein the management device transmitting a control signal for controlling the cyber attack updates the parameter based on a change in the attack scenario. The program according to claim 1, wherein the program starts or ends the cyber attack in accordance with an instruction from a management device that transmits a control signal for controlling the cyber attack. The program transmits the control signal via a predetermined dedicated network different from a network to which a signal of a cyber attack communicated between the plurality of information processing devices or the plurality of terminal devices is transmitted. The program according to claim 1. A history of operations performed in a corresponding information processing device or a corresponding terminal device or a corresponding cyber attack history is transmitted to the log collection unit for processing executed by the program according to the attack scenario. The program according to claim 1. Each time the cyber attack is executed or each time a countermeasure operation against the cyber attack is performed, the program is deployed to the corresponding information processing apparatus or the corresponding terminal device, and a program different from the program has a history or a corresponding program. The program according to claim 7, wherein a history of cyber attacks is transmitted to the log collection unit. For processing executed by the program according to the attack scenario, a history of operations performed in a corresponding information processing device or a corresponding terminal device or a corresponding cyber attack history is between the plurality of information processing devices or the plurality of the plurality of information processing devices. The program according to claim 7, wherein the program is transmitted to the log collection unit via a predetermined dedicated network different from a network to which a cyber attack signal communicated between terminal devices is transmitted. The program according to claim 1, wherein a program different from the program starts the program according to the attack scenario, and the started program executes the cyber attack.

Images