JP7019533B2 - Attack detection device, attack detection system, attack detection method and attack detection program - Google Patents

Description

The present application relates to an attack detection device, an attack detection system, an attack detection method and an attack detection program.

In recent years, cyber attacks have become more sophisticated, and can be prevented only by deploying security devices such as conventional firewalls, intrusion detection systems (IDS) or intrusion prevention systems (IPS). It's getting harder. One of the countermeasures against advanced cyber attacks is a system called Security Information and Event Management (SIEM). SIEM is a system that detects cyber attacks by correlating logs output by network devices such as computers, servers, and routers in the monitored system, and security devices such as firewalls or IDS / IPS.

However, since SIEM reads all the logs to be searched and performs correlation analysis, the processing load will increase when there are many devices inside the monitored system and when multiple cyber attacks are detected in parallel. Become. In that case, there is a problem that processing cannot be performed in real time.

In order to solve this problem, in the detection of cyber attacks that perform unauthorized communication, the number of communications from the device inside the monitored system to the communication destination on the blacklist is counted, and the number of communications is a certain number or more within the period. A method of detecting a cyber attack when the above is performed is disclosed (see, for example, Patent Document 1).

JP-A-2015-179979

In the above-mentioned Patent Document 1, since the cyber attack is detected according to the number of times of communication with the communication destination on the blacklist, the number of executions of the detection is reduced and the processing in real time is possible. However, since it is assumed that a cyber attack is performed more than a certain number of times, there is a problem that it is not possible to detect a cyber attack that does not involve communication with the outside and a cyber attack that is performed inside the monitored system and has a low communication frequency. rice field. In addition, since the blacklist is used, there is also a problem that cyber attacks from unknown communication destinations cannot be detected.

This application was made to solve the above-mentioned problems, and a cyber attack that exploits vulnerabilities including a cyber attack that does not involve communication with the outside and a cyber attack from an unknown communication destination is carried out from an external system. The purpose is to reduce the processing load by adjusting the execution cycle for early detection based on the obtained vulnerability information and performing log correlation analysis according to the detection rules.

The attack detection device disclosed in the present application has a log database in which logs generated in a monitored system equipped with a plurality of constituent devices are stored, and a detection rule in which the conditions for correlation analysis between the constituent devices and the log are recorded. An attack detection device equipped with a stored detection rule DB and a detection engine that detects and outputs a cyber attack by performing correlation analysis of logs according to the detection rule in a predetermined execution cycle. A vulnerability information record database that stores vulnerability information detected in the past by the detection device, a vulnerability information acquisition unit that acquires new vulnerability information, and a configuration that stores configuration information related to multiple components. A target device determination unit that determines a vulnerable component device as a target device from an information DB, new vulnerability information and configuration information, and a detection rule stored in the determination result and detection rule DB of the target device determination unit. A detection rule judgment unit that determines the detection rule that matches the target device and the component device, and a risk value calculation unit that calculates the risk value of the vulnerability from new vulnerability information. It is provided with an execution cycle update unit that updates the execution cycle for performing correlation analysis of logs according to the detection rule determined by the detection rule determination unit.

According to the attack detection device disclosed in the present application, cyber attacks that exploit vulnerabilities can be detected at an early stage, and the execution cycle for performing log correlation analysis according to the detection rules is adjusted to reduce the processing load. be able to.

FIG. 3 is a system configuration diagram including an attack detection device according to the first embodiment. It is a block diagram which shows an example of the hardware of an attack detection device. It is a flowchart which shows the process of the attack detection apparatus which concerns on Embodiment 1. It is a figure which shows the vulnerability information which concerns on Embodiment 1. FIG. It is a figure which shows the configuration information which concerns on Embodiment 1. It is a figure which shows the detection rule which concerns on Embodiment 1. FIG. It is a figure which shows the calculation method of the risk value which concerns on Embodiment 1. It is a figure which shows the update content of the execution cycle of the detection rule which concerns on Embodiment 1. FIG. It is a figure which shows the execution timing of the detection rule when the execution cycle of the detection rule which concerns on Embodiment 1 is changed. It is a system configuration diagram of the attack detection device which concerns on Embodiment 2. FIG. It is a flowchart which shows the process of the attack detection apparatus which concerns on Embodiment 2. It is a figure which shows the attack scenario which concerns on Embodiment 2. It is a figure which shows the item of the vulnerability information which concerns on Embodiment 3. It is a figure which shows the calculation method of the risk value which concerns on Embodiment 3. It is a figure which shows the configuration information which concerns on Embodiment 4. It is a figure which shows the item of the vulnerability information which concerns on Embodiment 4. It is a figure which shows the calculation method of the risk value which concerns on Embodiment 4.

Hereinafter, the attack detection device of the embodiment will be described with reference to the drawings, but the same or corresponding members and parts will be described with the same reference numerals in the drawings.

Embodiment 1.
FIG. 1 is a system configuration diagram including an attack detection device 100 according to the first embodiment. The attack detection device 100 is connected to the monitoring target system 200, the vulnerability information disclosure system 300, and the monitoring terminal 400. The attack detection system 500 includes an attack detection device 100 and a monitoring terminal 400. The attack detection device 100 is a device having a function of detecting a cyber attack, collects logs generated inside the monitored system 200, and performs correlation analysis of logs according to a detection rule in a predetermined execution cycle. By doing so, a cyber attack is detected, and the detected result is output to the monitoring terminal 400. The monitoring target system 200 is an information system including a plurality of constituent devices such as a computer, a server, a network device, and a security device. In FIG. 1, a plurality of constituent devices are shown as devices A to C. The vulnerability information disclosure system 300 is a system installed outside the attack detection device 100, and is a system that discloses vulnerability information of software (hereinafter referred to as S / W). The monitoring terminal 400 is a terminal that displays the detection result of the cyber attack output from the attack detection device 100, and is used by the observer.

The attack detection device 100 has an execution cycle (hereinafter referred to as DB) that performs correlation analysis between four databases (hereinafter referred to as DB. Vulnerability information recording DB 107, configuration information DB 108, detection rule DB 109, log DB 110) and logs according to the detection rules. , The detection rule execution cycle), the vulnerability information acquisition unit 101, the target device determination unit 102, the detection rule determination unit 103, the risk value calculation unit 104, the execution cycle update unit 105, and the detection engine 106. Be prepared.

The log DB 110 stores the log generated in the monitored system 200, and the detection rule DB 109 stores the detection rule in which the conditions for the correlation analysis between the devices A to C and the log are recorded. The detection engine 106 detects a cyber attack by performing a log correlation analysis according to a detection rule in a predetermined execution cycle capable of updating the execution cycle described later, and outputs the detected result to the monitoring terminal 400. do.

As shown in FIG. 2, the attack detection device 100 includes a processor 111 and a storage device 112 as an example of hardware. Although not shown, the storage device 112 includes a volatile storage device such as a random access memory and a non-volatile auxiliary storage device such as a flash memory. Further, the auxiliary storage device of the hard disk may be provided instead of the flash memory. The processor 111 executes the program input from the storage device 112. In this case, a program is input from the auxiliary storage device to the processor 111 via the volatile storage device. Further, the processor 111 may output data such as a calculation result to the volatile storage device of the storage device 112, or may store the data in the auxiliary storage device via the volatile storage device.

Next, the operation of updating the execution cycle of the detection rule in the attack detection device 100 will be described. FIG. 3 is a flowchart showing a process of updating the execution cycle of the detection rule. Vulnerability information record DB 107 stores vulnerability information detected in the past by the attack detection device 100. The vulnerability information acquisition unit 101 acquires vulnerability information from the vulnerability information disclosure system 300 (step S100). The vulnerability information disclosure system 300 is a system in which vulnerability information is generally disclosed on the Web, and is, for example, JVN iPedia operated by the Information-technology Promotion Agency (IPA). As shown in FIG. 4, for example, the vulnerability information records an outline of the vulnerability, the target S / W and S / W versions, the degree of impact, and the like. The vulnerability information acquisition unit 101 determines whether the vulnerability information acquired based on the past vulnerability information is new vulnerability information (step S101). If the acquired vulnerability information is new vulnerability information in the determination, the acquired new vulnerability information is recorded in the vulnerability information record DB 107 and notified to the target device determination unit 102 (step S102). .. Steps S100 to S102 are vulnerability information acquisition steps. If the acquired vulnerability information is the same as the past vulnerability information, the update operation is terminated without updating the execution cycle.

The configuration information DB 108 stores configuration information related to the devices A to C. For example, as shown in FIG. 5, the configuration information records the configuration device and the S / W and S / W versions operating on the device. The target device determination unit 102 performs a step of determining whether or not a vulnerable device is used in the monitored system 200 from the notified new vulnerability information and configuration information (step S103). If a vulnerable device is used in the determination, the device being used is determined as the target device, and the vulnerability information and the target device are notified to the detection rule determination unit 103. In the vulnerability information shown in FIG. 4 and the configuration information shown in FIG. 5, since the S / W (HogeSoft Ver1.1) targeted for the vulnerability is operating in the device A, the device A is vulnerable. It is judged as a certain target device. If the vulnerable device is not used, the update operation is terminated without updating the execution cycle.

The detection rule determination unit 103 compares the target device and the devices A to C from the notified determination result of the target device determination unit 102 and the detection rule stored in the detection rule DB 109, and determines a detection rule that matches these. A step of determining as a related detection rule is performed (step S104). As shown in FIG. 6, for example, the detection rule records the conditions for correlation analysis between the device A and the log of the device A. Examples of the conditions for the correlation analysis include, but are not limited to, the number of login failures n times (the n value is determined when the condition is set), or the log a 5 times in a row and then the log b. If there is a related detection rule in the determination, the vulnerability information is notified to the risk value calculation unit 104. Here, the target device is the device A, and in the detection rule shown in FIG. 6, the constituent devices are the device A and both are the same as the device A. Therefore, the detection rule determination unit 103 uses the detection rule of FIG. 6 as the related detection rule. The determination is made and the risk value calculation unit 104 is notified. If there is no related detection rule, the update operation is terminated without updating the execution cycle.

The risk value calculation unit 104 calculates the risk value of the vulnerability from the notified vulnerability information, and performs a step of notifying the calculated risk value to the execution cycle update unit 105 (step S105). For example, as a method of calculating a risk value, as shown in FIG. 7, there is a method of converting an item of the degree of impact included in the vulnerability information into a risk value according to the degree of impact. Here, the greater the degree of influence, the larger the natural number is given as the risk value. Further, in FIG. 7, the risk value is set to three stages of 1 to 3, but the risk value is not limited to this, and may be further changed to a plurality of stages according to the monitored system 200.

The execution cycle update unit 105 performs a step of updating the execution cycle of the related detection rule determined by the detection rule determination unit 103 based on the notified risk value (step S106). For example, as shown in FIG. 8, the update content of the execution cycle of the detection rule updates the execution cycle to 1 / N (N is a natural number) according to the obtained risk value. In FIG. 7, the risk value is a natural number that increases as the risk increases. Therefore, in FIG. 8, the risk value calculated in FIG. 7 is substituted into N and the execution cycle is set to update. As the risk value increases, the value of N is increased to shorten the execution cycle, so that the detection of cyber attacks can be accelerated. The update operation ends when the execution cycle of the detection rule is updated.

If the execution cycle is updated with N as a non-natural number, the detection of cyber attacks may be delayed. FIG. 9 is a diagram showing an example of the execution timing of the detection rule when the execution cycle of the detection rule is changed. Here, the execution cycle of the detection rule is set to 1/2 (N = 2) or 2/3 (N = 1.5). Before updating the execution cycle, a cyber attack is detected at the time point 1 shown in the upper part of FIG. When the execution cycle is halved, the execution timing of the detection rule is 2 or 3 shown in the middle of FIG. 9, and when the cyber attack occurs at the timing of B, the cyber attack occurs at the same time as before the update cycle change. However, at the timing of A, a cyber attack can be detected at the time of 2 which is earlier than before the update cycle change. However, when the execution cycle is set to 2/3, the execution timing of the detection rule is 4 or 5 shown in the lower part of FIG. 9, so cyber attacks are detected more than the time of 1 before the change, such as the time of 5. The timing to do it may be delayed. In order to avoid delaying the timing of detecting a cyber attack, the execution cycle is updated with N as a natural number.

As a method of restoring the updated execution cycle, for example, there is a method of upgrading the S / W version or a method of manually returning the update cycle when the vulnerability is resolved, but the method is not limited to these methods. .. Further, in the present embodiment, the execution cycle of the detection rule related to the target device is updated by associating the detection rule with the constituent device, but the present invention is not limited to this, and the detection rule and the S / W may be associated with each other. ..

As described above, the attack detection device 100 calculates the risk value based on the new vulnerability information obtained from the external system, and frequently executes the detection rule related to the vulnerability with the high risk value. Since the execution cycle is updated, cyber attacks that exploit the vulnerability can be detected at an early stage. In addition, since the number of times the detection rule is executed can be reduced while ensuring the security of cyber attack detection, the processing load of the attack detection device can be reduced.

It should be noted that a program described in a language that can be executed by a computer can be created for the process executed by the attack detection device 100, and by executing the program by the computer, the same effect as that of the above embodiment can be obtained.

Embodiment 2.
The configuration and operation of the attack detection device 100 according to the second embodiment will be described. FIG. 10 is a system configuration diagram including the attack detection device 100 according to the second embodiment, and FIG. 11 is a flowchart showing a process of updating the execution cycle of the detection rule of the attack detection device 100. In the first embodiment, the security of cyber attack detection and the reduction of the processing load are realized by updating the execution cycle of the detection rule, but if the event caused by the vulnerability does not remain in the log, each detection is performed. Even if the execution cycle of the rule is increased, it is not possible to detect a cyber attack that exploits the vulnerability. Therefore, in the second embodiment, the execution cycle of a series of detection rules related to a specific cyber attack is collectively updated based on the attack scenario. It is something to do. Since the other configurations are the same as those described in the first embodiment, the same reference numerals are given and the description thereof will be omitted.

As shown in FIG. 10, the attack detection device 100 includes the attack detection device 100 shown in FIG. 1 plus the attack scenario DB 600 to provide five DBs. Other configurations are the same as in FIG. The attack scenario DB 600 stores an attack scenario in which the contents of each attack phase of a cyber attack, the detection method, the constituent devices, and the detection rules are recorded.

Next, the operation of updating the execution cycle of the detection rule in the attack detection device 100 will be described with reference to FIG. Since the processing of steps S100 to S103 from the acquisition of the vulnerability information to the determination of whether the target device of the vulnerability is used in the monitored system is the same as that of the first embodiment, the description thereof will be omitted. ..

The detection rule determination unit 103 uses the notified determination result of the target device determination unit 102 and the attack scenario stored in the attack scenario DB 600 to determine the target device (referred to as device A as in the first embodiment) and the constituent devices. Are compared, and an attack scenario in which they match is determined as a related attack scenario (step S200). For example, in the attack scenario, as shown in FIG. 12, cyber attacks are classified into several phases, and the contents, detection methods, constituent devices, and detection rules of each phase are recorded. FIG. 12 is an example of an attack scenario in which a cyber attack that leaks data of the device A is classified into four phases of intrusion, infection, attack, and external communication. If there is a related attack scenario in the determination, the vulnerability information is notified to the risk value calculation unit 104. If there is no related attack scenario, the update operation is terminated without updating the execution cycle.

The risk value calculation unit 104 calculates the risk value of the vulnerability from the notified vulnerability information, and performs a step of notifying the calculated risk value to the execution cycle update unit 105 (step S105). Since the method of calculating the risk value is the same as that of the first embodiment, the description thereof will be omitted.

The execution cycle update unit 105 performs a step of updating so that the execution cycle of a series of detection rules associated with the related attack scenario determined by the detection rule determination unit 103 is shortened as the notified risk value increases ( Step S201). In the example of FIG. 12, since the device A exists in the constituent devices of the attack scenario, the detection rules (1) to (5) form a series of detection rules, and the detection rules of both the device A and the firewall form a series of detection rules. .. In this case, not only the detection rule of the device A but also the execution cycle of the detection rule of the firewall is changed, so that early detection of a cyber attack becomes possible. Since the content of updating the execution cycle of the detection rule is the same as that of the first embodiment, the description thereof will be omitted. The update operation is terminated by updating the execution cycle.

In this embodiment, the execution cycle of a series of detection rules associated with the attack scenario related to the target device is updated by associating the attack scenario with the constituent device, but the execution cycle is not limited to this, and the attack scenario and S / W may be associated.

As described above, since the attack detection device 100 collectively updates the execution cycle of a series of detection rules related to a specific cyber attack based on the attack scenario stored in the attack scenario DB 600, it is caused by a vulnerability. Even if the event is not recorded in the log, it is possible to detect a cyber attack that exploits the vulnerability at an early stage.

Embodiment 3.
The operation of the attack detection device 100 according to the third embodiment will be described. In the first embodiment, the risk value of the vulnerability was calculated from only the item of the degree of impact included in the vulnerability information, but when there are multiple items in the vulnerability information, it is appropriate according to the actual situation of the vulnerability. Since there is a possibility that the risk value cannot be calculated, in the third embodiment, the risk value is calculated by using a plurality of items related to the vulnerability included in the vulnerability information. The system configuration diagram and the flowchart in the third embodiment are the same as those in the first embodiment.

A method of calculating the risk value of the vulnerability in the operation of updating the execution cycle of the detection rule of the attack detection device 100 will be described with reference to FIGS. 13 and 14. FIG. 13 is a diagram showing items related to the vulnerability of vulnerability information, and FIG. 14 is a diagram showing a method of calculating a risk value. For example, as shown in FIG. 13, there are four items related to vulnerabilities: the degree of impact on confidentiality, the degree of impact on integrity, the degree of impact on availability, and the complexity of attack conditions. There are three levels of risk, high, medium, and low, and for each degree of impact, the higher the risk of concern, the larger the natural number (here, 1 to 3) is given as the risk value. As shown in Fig. 14, the risk value is calculated by first setting the maximum value of the three items of the vulnerability information, that is, the degree of impact on confidentiality, the degree of impact on integrity, and the degree of impact on availability. It is defined as the degree of impact, and the value obtained by multiplying the complexity of the attack condition by the degree of impact of the vulnerability is used as the risk value. For example, if the complexity of the attack condition is low (the numerical value given because it can be easily attacked is 3) and the degree of influence is high (the given numerical value is 3), the calculation result of the risk value is the maximum at 9. On the contrary, when the complexity of the attack condition is high (the value given is 1 because it is difficult to attack) and the degree of influence is low (the value given is 1), the calculation result of the risk value is the minimum at 1. By using such a calculation method, it is possible to calculate the risk value according to the substance of the vulnerability.

The item of vulnerability information and the calculation method of the risk value shown in this embodiment are not limited to this in one example, and may be changed according to the item of the obtained vulnerability information and the monitored system 200. I do not care.

As described above, since the attack detection device 100 calculates the risk value using a plurality of items related to the vulnerability included in the vulnerability information, the risk value can be calculated according to the substance of the vulnerability. ..

Embodiment 4.
The operation of the attack detection device 100 according to the fourth embodiment will be described. In the first embodiment, the risk value is calculated only from the vulnerability information, and it is considered that the risk value of the component device having the same operation S / W is the same regardless of the role of each component device. Since the degree of influence on the system when a cyber attack is received changes in the component devices having different roles such as the database server to be stored and the application server multiplexed for load distribution, in the fourth embodiment, the component devices have different roles. The information asset value is defined in advance from the role, and the risk value is calculated based on the information asset value and vulnerability information of the component equipment. The system configuration diagram and the flowchart in the fourth embodiment are the same as those in the first embodiment.

A method of calculating the risk value of the vulnerability in the operation of updating the execution cycle of the detection rule of the attack detection device 100 will be described with reference to FIGS. 15 to 17. FIG. 15 is a diagram showing the configuration information stored in the configuration information DB 108, FIG. 16 is a diagram showing items related to the vulnerability of the vulnerability information, and FIG. 17 is a diagram showing a method of calculating a risk value. For example, in the configuration information, as shown in FIG. 15, the information asset value is recorded in addition to the configuration device and the S / W and S / W versions operating on the device. The information asset value is set in three stages of high, medium, and low from the three viewpoints of confidentiality, integrity, and availability in each component device. For example, in a configuration device such as a database server where leakage and alteration of stored data is a problem, the items of confidentiality and integrity are set high, and data is not retained like a security device, but it is always in operation. The availability item is set high for the components where it is important to do so. Since the constituent equipment shown in FIG. 15 corresponds to the former, the items of confidentiality and integrity are set high.

For example, as shown in Fig. 16, there are three items related to vulnerabilities: the degree of impact on confidentiality, the degree of impact on integrity, and the degree of impact on availability. There are three levels of high, medium, and low, and for each degree of influence, the higher the level, the larger the natural number (here, 1 to 3) is given as the risk value. As shown in FIG. 17, the risk value is calculated by multiplying the confidentiality, integrity, and availability of each of the constituent devices determined as the target device by the information asset value and the degree of influence of the vulnerability information. Calculate the degree of impact on assets. Next, the maximum value is taken as the risk value among the degrees of impact on each information asset of confidentiality, integrity, and availability. By using such a calculation method, for example, when a vulnerability with a high impact on confidentiality occurs, the risk value of the device with high information asset value regarding airtightness becomes high, and the role of the component device becomes the risk value. It will be possible to reflect.

The information asset value item, vulnerability information item, and risk calculation method shown in this embodiment are not limited to this one, but depend on the obtained vulnerability information item and the monitored system 200. You may change it.

As described above, in this attack detection device 100, the information asset value is defined in advance from the role of the component device, and the risk value is calculated based on the information asset value and the vulnerability information of the component device. The role can be reflected in the risk value, and the execution cycle of the appropriate detection rule can be set.

Although the present application describes various exemplary embodiments and examples, the various features, embodiments, and functions described in one or more embodiments are applications of a particular embodiment. It is not limited to, but can be applied to embodiments alone or in various combinations.
Therefore, innumerable variations not illustrated are envisioned within the scope of the techniques disclosed herein. For example, it is assumed that at least one component is modified, added or omitted, and further, at least one component is extracted and combined with the components of other embodiments.

100 Attack detection device, 101 Vulnerability information acquisition unit, 102 Target device judgment unit, 103 Detection rule judgment unit, 104 Risk value calculation unit, 105 Execution cycle update unit, 106 Detection engine, 107 Vulnerability information recording DB, 108 Configuration information DB, 109 detection rule DB, 110 log DB, 111 processor, 112 storage device, 200 monitored system, 300 vulnerability information disclosure system, 400 monitoring terminal, 500 attack detection system, 600 attack scenario DB

Claims (7)

A log database that stores logs generated in a monitored system equipped with multiple components, and
A detection rule DB in which a detection rule in which the constituent devices and the conditions for correlation analysis of the log are recorded is stored, and
In an attack detection device equipped with a detection engine that detects and outputs a cyber attack by performing correlation analysis of the log according to the detection rule at a predetermined execution cycle.
Vulnerability information record DB that stores vulnerability information detected in the past by the attack detection device,
Vulnerability information acquisition department that acquires new vulnerability information,
A configuration information database that stores configuration information related to the plurality of configuration devices, and
A target device determination unit that determines a vulnerable component device as a target device from the new vulnerability information and the configuration information,
A detection rule determination unit that determines a detection rule in which the target device and the constituent device match from the determination result of the target device determination unit and the detection rule stored in the detection rule DB.
The risk value calculation unit that calculates the risk value of the vulnerability from the new vulnerability information,
It is characterized by including an execution cycle update unit that updates the execution cycle for performing correlation analysis of the log according to the detection rule determined by the detection rule determination unit as the risk value increases. Attack detection device. It also has an attack scenario DB that stores attack scenarios that record the contents of each attack phase of cyber attacks, detection methods, components, and detection rules.
The detection rule determination unit determines an attack scenario in which the target device and the constituent device match from the determination result of the target device determination unit and the attack scenario.
The risk value calculation unit calculates the risk value of the vulnerability from the new vulnerability information.
The execution cycle update unit updates the execution cycle for performing correlation analysis of the log according to the detection rule recorded in the attack scenario determined by the detection rule determination unit as the risk value increases. The attack detection device according to claim 1, wherein the attack detection device is to be used. The attack detection device according to claim 1 or 2, wherein the risk value calculation unit calculates the risk value based on items related to a plurality of vulnerabilities included in the new vulnerability information. The configuration information includes the information asset value of the configuration device.
One of claims 1 to 3, wherein the risk value calculation unit calculates the risk value based on the items related to a plurality of vulnerabilities included in the new vulnerability information and the information asset value. The attack detection device according to item 1. An attack detection system comprising the attack detection device according to any one of claims 1 to 4 and a monitoring terminal for displaying a cyber attack detection result output from the attack detection device. In the attack detection method of the attack detection device that detects and outputs cyber attacks
Based on the acquired new vulnerability information and the configuration information about multiple components of the monitored system, the vulnerable component is determined as the target device.
From the detection rule in which the condition of the correlation analysis of the log generated in the constituent device and the monitored system is recorded and the determination result of the target device, the detection rule in which the constituent device and the target device match is determined. ,
Calculate the risk value of the vulnerability from the new vulnerability information,
An attack detection method characterized in that, as the risk value increases, the execution cycle for performing correlation analysis of the log according to the determined detection rule is updated so as to be shortened. In the attack detection program of the attack detection device that detects and outputs cyber attacks
Vulnerability information acquisition step to acquire new vulnerability information based on the vulnerability information detected in the past by the attack detection device, and
A target device determination step for determining a vulnerable component device as a target device from the new vulnerability information and configuration information related to a plurality of component devices included in the monitored system.
From the detection rule in which the condition of the correlation analysis of the log generated in the constituent device and the monitored system is recorded and the judgment result of the target device determination step, the detection rule in which the constituent device and the target device match is determined. Judgment detection rule Judgment step and
The risk value calculation step for calculating the risk value of the vulnerability from the new vulnerability information,
It is characterized by including an execution cycle update step for updating the execution cycle for performing correlation analysis of the log according to the detection rule determined in the detection rule determination step as the risk value increases. Attack detection program.

Images