WO2015029464A1 - Simulation device, information generation device, simulation method, simulation program, environment provision system, environment provision method, and program - Google Patents

Abstract

The purpose of the present invention is to provide a simulation device that makes it possible to simulate an operation trend of a production environment without affecting the production environment. A simulation device (111) that simulates an operation that is carried out in a production environment system comprising an access log (1022) in which a plurality of operation histories that indicate the history of operations are stored is provided with: an extraction unit (121) that extracts a plurality of operation histories as an extracted log (122) from the access log (1022) on the basis of an extraction condition (126) that is a condition for extracting an operation history from the access log (1022); a sequence generation unit (123) that uses a processing device to generate simulation data (1112) that indicates the sequence of operations to be simulated on the basis of the extracted log (122) that is extracted by the extraction unit (121); and an execution unit (125) that uses the processing device to run the simulation data (1112) that is generated by the sequence generation unit (123).

Description

Simulation device, information generation device, simulation method, simulation program, environment providing system, environment providing method, and program

The present invention relates to a simulation device, an information generation device, a simulation method, and a simulation program. In particular, the present invention relates to an information generation apparatus that generates a simulation procedure for simulating an operation performed in the operation system using an operation history of the operation system to be simulated, a simulation apparatus including the information generation apparatus, a simulation method, and a simulation program.

Conventionally, as a reproduction method for automatically simulating or reproducing the operation of a computer, there is a method of reproducing an operation record for the purpose of a regression test or the like (for example, see Patent Document 1). In this reproduction method, first, the operation content of an actual user (tester) is explicitly recorded as an operation history using a dedicated operation history recording device. Next, the recorded operation history is read, and the operation of the user (tester) is reproduced by a dedicated operation reproduction device incorporated in the test environment or the like. According to this reproduction method, repeated operation by the user (tester) in the test environment becomes unnecessary, and the efficiency of the test can be improved.

Further, as a system simulation method for simulating the operation of the system, there is a method of simulating a response to an input to the system for the purpose of operation training (see, for example, Patent Document 2). This system simulation method simulates the response of the system according to the operation of the operator (trainer) without preparing an actual system when performing system operation training. According to this system simulation method, it is possible to perform operation training and the like without an actual system.

JP 2008-117093 A JP-A-10-207580

When building a training environment for training to detect unforeseen situations that have occurred in the system due to obstacles or cyber attacks, it is necessary to simulate the normal system operation tendency during production in the training environment. is there. In this case, not only the operation of a single user but also the operation of the entire system is required.
In addition, in order to adjust the difficulty level of training, it is necessary to simulate the movement tendency in a training environment having a different scale from the actual environment. In other words, it is necessary not to faithfully reproduce the operation of the system in actual operation but to simulate a trend such as processing contents, processing frequency, and access frequency.

Patent Document 1 is a method for reproducing an operation record recorded by a dedicated operation history recording device, and the operation content must be explicitly recorded. When the operation details must be recorded explicitly, the processing details of the production environment will be recorded, and there is a problem that the normal operation may be affected by increasing the load on the system during the production operation. . In addition, when the operation contents must be explicitly recorded, there is a problem that only the operation in the time zone when the recording is acquired can be reproduced, and various operation patterns cannot be prepared.
Moreover, in patent document 1, since operation | movement can be reproduced only by the structure of an environment equivalent to a production environment, the objective of preparing the training environment of a desired difficulty cannot be achieved, but the subject that it cannot respond flexibly to a change in scale. There is.

Patent Document 2 is a method of simulating only a response to an input, and does not reproduce the processing of the system, so that there is a problem that the operation of the entire system cannot be simulated.

The present invention has been made to solve the above-described problems, and an object thereof is to provide a simulation device that can simulate the overall operation tendency of a production environment without affecting the production environment. To do.

An extraction unit that extracts a plurality of operation histories as extraction operation histories from the operation history information based on an extraction condition that is a condition for extracting operation histories from operation history information in which a plurality of operation histories indicating operation histories are accumulated;
Based on the extraction operation history extracted by the extraction unit, a procedure generation unit that generates a simulation procedure indicating a procedure of the operation to be simulated by a processing device;
And an execution unit that executes the simulation procedure generated by the procedure generation unit using a processing device.

According to one aspect of the simulation device according to the present invention, based on the extraction condition, an extraction unit that extracts a plurality of operation histories from the operation history information of the operation system as an extraction operation history, and based on the extracted extraction operation history And a generation unit that generates a simulation procedure indicating the procedure of the operation to be simulated, and an execution unit that executes the generated simulation procedure, so that the entire operation system can be operated without affecting the operation system. Simulation of movement tendency can be performed.

1 is an overall configuration diagram of a production environment system 10 and a simulation system 11 according to Embodiment 1. FIG. 2 is a block configuration diagram of a simulation device 111 according to Embodiment 1. FIG. 6 is a diagram illustrating an example of a configuration of simulation data 1112 according to Embodiment 1. FIG. 2 is a diagram illustrating an example of a hardware configuration of a simulation apparatus 111 according to Embodiment 1. FIG. 2 is an overall configuration diagram of a production environment system 10 and a simulation system 11 according to Embodiment 1, and is a diagram for explaining the operation of each unit of the simulation device 111. FIG. 6 is a diagram showing an example of an access log 1022 according to Embodiment 1 and an example of an extraction log 122 extracted by an extraction unit 121. FIG. 6 is a flowchart showing an operation of a simulated environment generation process by a procedure generation unit 123 and a file generation unit 124 according to the first embodiment. 6 is a flowchart showing an operation of a simulated environment generation process by a procedure generation unit 123 and a file generation unit 124 according to the first embodiment. FIG. 4 is an overall configuration diagram of a production environment system 10 and a simulation system 11 according to a third embodiment. It is a figure which shows an example of a structure of the data for simulation 6112 which concerns on Embodiment 3. FIG. FIG. 6 is a block configuration diagram of a simulation device 111 according to a third embodiment. FIG. 10 is an overall configuration diagram of a production environment system 10 and a simulation system 11 according to a third embodiment, and is a diagram for explaining the operation of each unit of a simulation apparatus 111. 10 is a flowchart showing an operation of a simulated environment generation process by a procedure generation unit 123 and a file generation unit 124 according to the third embodiment. It is a whole block diagram of the environment provision system 200 which concerns on Embodiment 5. FIG. FIG. 20 is a diagram illustrating an example of a configuration of a normal business scenario 2311 according to the fifth embodiment. It is a figure explaining the reproduction | regeneration system of the normal business by the terminal 1131 which concerns on Embodiment 5. FIG. It is a figure explaining the reproduction | regeneration system of the cyber attack by the attack terminal 212 which concerns on Embodiment 5, and the infected terminal 1131x. It is a figure which shows an example of a structure of the training environment information 2314 which concerns on Embodiment 5. FIG. 16 is a flowchart showing a flow of an environment providing method (environment providing process) of the environment providing system 200 according to the fifth embodiment.

Embodiment 1 FIG.
FIG. 1 is an overall configuration diagram of a production environment system 10 and a simulation system 11 according to the present embodiment.
The outline of the configuration and functions of the production environment system 10 and the simulation system 11 according to the present embodiment will be described with reference to FIG.

The production environment system 10 is an example of an operation system that stores operation history information (access log 1022) in which an operation history indicating an operation history is accumulated in a storage device of the file server 102.
The simulation system 11 is a training environment system that simulates the operation trend of the production environment system 10 and provides a training environment for operation training.

The production environment system 10 includes a terminal group 101 composed of a plurality of terminals and a file server 102.
The file server 102 is an example of a storage device of an operation system that stores a file group 1021 composed of a plurality of files and an access log 1022.
The access log 1022 is a general log that the file server 102 outputs for auditing or failure analysis. The access log 1022 stores a plurality of log records (log entries) that are operation histories.

The access log 1022 is an example of operation history information in which a log record (operation history) indicating a history of access from the terminal group 101 to the file group 1021 is accumulated. Access from the terminal group 101 to the file group 1021 is an example of an operation performed in the production environment system 10.

Hereinafter, terminals included in the terminal group 101 may be simply referred to as terminals. In addition, files included in the file group 1021 may be simply referred to as files.
The terminal accesses the file group 1021 stored in the file server 102 via the network 103.

The simulation system 11 simulates an operation tendency of access from the terminal group 101 to the file group 1021 performed in the production environment system 10.
The simulation system 11 includes a simulation device 111 and a simulation file server 112.
The simulation device 111 includes a simulation terminal group 1111 composed of a plurality of simulation terminals and simulation data 1112.
The simulation file server 112 is an example of a storage device that stores a simulation file group 1121 including a plurality of simulation files.

Based on the access log 1022 of the production environment system 10, the simulation apparatus 111 generates simulation data 1112 that is a simulation procedure indicating a simulation procedure. At this time, the simulation apparatus 111 generates simulation data 1112 so that the number of terminals or the number of users simulated in the simulation system 11 is different from that in the production environment system 10 in order to adjust the difficulty level of the training environment.
The simulation data 1112 is a simulation procedure indicating a procedure for accessing the simulation file group 1121 from the simulation terminal group 1111. For example, an access time, an access type, and the like are set.

The simulation apparatus 111 generates an initial file configuration of the simulation file group 1121 necessary for simulating the operation according to the simulation data 1112 and stores the initial file configuration in the simulation file server 112. The simulation device 111 may be configured not to store the generated initial file configuration of the simulation file group 1121 in the simulation file server 112. The simulation device 111 may be configured to store the initial file configuration of the generated simulation file group 1121 in, for example, a storage device included therein. In this case, the simulation file server 112 becomes unnecessary.

However, since the simulation apparatus 111 simulates the operation of the production environment system 10, it is assumed to have the same configuration as the production environment system 10 as much as possible. For example, when the production environment system 10 accesses the file group 1021 stored in the file server 102 from the terminal group 101, on the simulation system 11 side, the simulation file server having the same specifications as the file server 102 is used. 112 preferably stores the initial file structure of the simulated file group 1121. Alternatively, the simulation file group 1121 may be stored in a storage device such as a hard disk or flash memory inside the simulation apparatus 111 in order to adjust the training environment.

The simulation apparatus 111 performs simulation according to the simulation procedure of the simulation data 1112 using the simulation terminal group 1111 and the initial file configuration of the simulation file group 1121.

FIG. 2 is a block configuration diagram of the simulation apparatus 111 according to the present embodiment. A block configuration of the simulation apparatus 111 according to the present embodiment will be described with reference to FIG.

As illustrated in FIG. 2, the simulation apparatus 111 includes an information generation unit 1110 and an execution unit 125. The information generation unit 1110 includes an extraction unit 121 and a simulated environment generation unit 128. The simulated environment generation unit 128 includes a procedure generation unit 123 and a file generation unit 124.
In addition, the simulation apparatus 111 stores the extraction condition 126, the extraction log 122, and simulation data 1112 in a storage device. The simulation file group 1121 may be stored in the simulation file server 112 as illustrated in FIG. 2, or may be stored in a storage device inside the simulation apparatus 111.

The extraction condition 126 is a condition for extracting a log record (operation history) from the access log 1022. As described above, since the simulation system 11 provides a training environment for operation training, the difficulty level of the training environment can be flexibly adjusted. The extraction condition 126 is for adjusting the training environment. For example, an operator name, a terminal ID, a terminal address, and the like of a log record (operation history) extracted from the access log 1022 are designated. The operator's name, terminal ID, terminal address, etc. are examples of identifiers set in advance as the extraction condition 126.
The extraction condition 126 can be appropriately set by a system administrator or the like.

The information generation unit 1110 is an example of an information generation apparatus that generates information used for simulating an operation performed in the production environment system 10. The simulation data 1112, the initial file configuration of the simulation file group 1121, and the like are examples of information used for simulating operations generated by the information generation unit 1110 (information generation device).

The extraction unit 121 extracts a plurality of log records from the access log 1022 as the extraction log 122 based on the extraction condition 126. The extraction log is an example of an extraction operation history.
Based on the extraction log 122 extracted by the extraction unit 121, the procedure generation unit 123 generates simulation data 1112 indicating the procedure of the operation to be simulated by the processing device. The simulation data 1112 is an example of a simulation procedure.

Based on the extraction log 122 extracted by the extraction unit 121, the simulation environment generation unit 128 includes simulation data 1112 that is a procedure of simulation operation, and a simulation file group 1121 that includes a simulation file 1121a on which the operation is performed. Is generated.

The procedure generation unit 123 eliminates inconsistencies between log records that occur when a plurality of log records included in the extraction log 122 are simulated. The procedure generation unit 123 corrects at least one of the plurality of log records so that the inconsistency is eliminated, and sets the extracted log 122 in which at least one log record is corrected as simulation data 1112.
Based on the simulation data 1112, the file generation unit 124 generates a simulation file 1121 a that is an operation target included in the simulation data 1112. The simulation file group 1121 includes at least one simulation file 1121a.
The procedure generation unit 123 and the file generation unit 124 may be configured as separate functional blocks, or may be configured as one simulated environment generation unit 128 to realize the function.

The execution unit 125 executes the simulation procedure of the simulation data 1112 for the simulation file group 1121 generated by the file generation unit 124.
The file generation unit 124 needs to configure the simulated file group 1121 with a necessary initial file configuration in accordance with the processing content of the simulation data 1112 before the execution of the simulation by the execution unit 125 is started. That is, it is necessary that a directory structure and files necessary for the processing contents to be implemented in the simulation exist.

In this embodiment, the simulation terminal group 1111 is configured on the simulation apparatus 111. However, the necessary number of terminals are actually prepared, and operation is performed using the simulation data 1112 prepared for each terminal. A trend may be simulated. The function of the simulation system 11 does not depend on the configurations of the simulation device 111, the simulation terminal group 1111, the simulation file server 112, and the like.

FIG. 3 is a diagram showing an example of the configuration of the simulation data 1112 according to the present embodiment.
The simulation data 1112 stores a plurality of log records that are a plurality of operations.
The log record indicates an access time 21 indicating an access interval necessary for the operation of the simulated terminal group 1111, an access user 22 accessing the simulated file group 1121, an access type 23 such as WRITE and READ, and a file to be operated. Information such as the access file 24 is stored.

The access time 21 is set to the time from the start of simulation. For example, the access time 21 “8” of the second record means that the operation of the record NO2 is executed 8 seconds after the simulation is started.
An identifier for identifying an operator is set for the access user 22. The identifier for identifying the operator is, for example, a user name. In addition, the MAC address of the terminal may be used.

In the access type 23, an operation type is set such as “WRITE”, “READ”, and “DELETE”.
In the access file 24, the file name and path name of the simulation file 1121a to be accessed are set.
As described above, the simulation data 1112 is set with information necessary for performing the simulation.

FIG. 4 is a diagram illustrating an example of a hardware configuration of the simulation apparatus 111 according to the present embodiment.
A hardware configuration example of the simulation apparatus 111 will be described with reference to FIG.

The simulation device 111 is a computer, and each element of the simulation device 111 can be realized by a program.
As a hardware configuration of the simulation device 111, an arithmetic device 901, an external storage device 902, a main storage device 903, a communication device 904, and an input / output device 905 are connected to the bus.

The arithmetic device 901 is a CPU (Central Processing Unit) that executes a program.
The external storage device 902 is, for example, a ROM (Read Only Memory), a flash memory, or a hard disk device.
The main storage device 903 is a RAM (Random / Access / Memory).
The communication device 904 is, for example, a communication board or the like, and is connected to a LAN (Local / Area / Network) or the like. The communication device 904 is not limited to a LAN, but includes an IP-VPN (Internet, Protocol, Private, Network), a wide area LAN, an ATM (Asynchronous / Transfer / Mode) network, a WAN (Wide / Area / Network), or the Internet. It does not matter if it is connected to. LAN, WAN, and the Internet are examples of networks.
The input / output device 905 is, for example, a mouse, a keyboard, a display device, or the like. Instead of the mouse, a touch panel, touch pad, trackball, pen tablet, or other pointing device may be used. The display device may be an LCD (Liquid / Crystal / Display), a CRT (Cathode / Ray / Tube), or another display device.

The program is normally stored in the external storage device 902, and is loaded into the main storage device 903 and sequentially read into the arithmetic device 901 and executed.
The program is a program that realizes a function described as “unit” shown in the block configuration diagram.
Further, an operating system (OS) is also stored in the external storage device 902. At least a part of the OS is loaded into the main storage device 903, and the arithmetic unit 901 executes the OS while “˜” shown in the block configuration diagram. The program that realizes the function of “part” is executed.
An application program is also stored in the external storage device 902, and is sequentially executed by the arithmetic device 901 while being loaded in the main storage device 903.
Information such as “˜table” is also stored in the external storage device 902.

In the description of the present embodiment, “determining”, “determining”, “extracting”, “detecting”, “setting”, “registering”, “selecting” ”,“ Generate ”,“ Input of ”,“ Output of ”, etc. Information, data, signal values, and variable values indicating the results of the processing are stored in the main storage device 903 as files. Yes.
In addition, data received by the simulation device 111 is stored in the main storage device 903.
Further, the encryption key / decryption key, random number value, and parameter may be stored in the main storage device 903 as a file.

Note that the configuration of FIG. 4 is merely an example of the hardware configuration of the simulation apparatus 111, and the hardware configuration of the simulation apparatus 111 is not limited to the configuration illustrated in FIG. .

FIG. 5 is an overall configuration diagram of the production environment system 10 and the simulation system 11 according to the present embodiment, and is a diagram for explaining the operation of each unit of the simulation apparatus 111.
The operation of each part of the simulation apparatus 111 will be described with reference to FIGS. Each part of the simulation device 111 shown in FIG. 2 implements a simulation method by the simulation device 111 by executing processing in cooperation with hardware resources such as a processing device, a storage device, and an input / output device included in the simulation device 111. To do. For example, the function of the simulation device 111 is realized by reading a simulation program stored in the main storage device of the simulation device 111 and executing it by the processing device.

The extraction unit 121 executes an extraction process 121a.
In the extraction process 121 a, the extraction unit 121 extracts a log record from the access log 1022 based on the extraction condition 126 and sets it as the extraction log 122. In order to adjust the difficulty level of the training environment, for example, the extraction process 121a reduces the number of users simulated by the simulation system 11 from the number of users of the production environment system 10. The extraction log 122 is a target user excerpt log in which only the log records related to necessary users are extracted from the access log 1022 by the extraction unit 121.

The procedure generation unit 123 executes a procedure generation process 123a.
In the procedure generation process 123a, the procedure generator 123 generates simulation data 1112 from the extracted log 122 that narrows down the users.
The file generation unit 124 executes a file generation process 124a.
In the file generation process 124 a, the file generation unit 124 generates an initial file configuration of the simulated file group 1121 from the extraction log 122.

The execution unit 125 executes a simulation execution process 125a.
In the simulation execution process 125a, the execution unit 125 executes access to the simulation file group 1121 from the simulation terminal group 1111 according to the simulation procedure indicated by the simulation data 1112.

FIG. 6 is a diagram illustrating an example of the access log 1022 according to the present embodiment and an example of the extraction log 122 extracted from the access log 1022 by the extraction unit 121.
As shown in FIG. 6, the access log 1022 stores log records 10221 to 10224 which are operation histories. A log record is also called a log entry. The extraction log 122 is extracted by the extraction processing 121 a by the extraction unit 121. The extraction log 122 stores log records 1221 to 1223 that are operations to be simulated.
In the extraction process 121a, if the target log is narrowed down and the extraction log 122 is simulated as it is, there is a possibility that inconsistency occurs that the simulation operates in a state where necessary data is missing.

As illustrated in FIG. 6, the extraction unit 121 extracts the extraction log 122 based on the extraction condition “user A, user B, user D” included in the log record to be extracted.
The log record 10223 related to the user C is deleted from the access log 1022 by the extraction process 121 a by the extraction unit 121. In the access log 1022, “User C creates file 1” (log record 10223) and then “User D reads file 1” (log record 10224). Since “Create File 1” does not exist, there is an inconsistency that a file to be read by the user D does not exist.
That is, the operation of the log record 1223 is an operation that cannot be executed without the operation of the log record 10223.

The procedure generation unit 123 corrects the extraction log 122 so as to eliminate the inconsistency as described above, and generates simulation data 1112.

7 and 8 are flowcharts showing an example of the operation of the simulated environment generation process by the procedure generation unit 123 and the file generation unit 124 according to the present embodiment. The simulated environment generation process (S100) includes a procedure generation process 123a by the procedure generation unit 123 and a file generation process 124a by the file generation unit 124.
Although the procedure generation unit 123 and the file generation unit 124 have been described as separate blocks, for example, the procedure generation unit 123 and the file generation unit 124 may be configured as one simulated environment generation unit 128. Here, the operation of one simulated environment generation unit 128 will be described.
In the following description of the simulated environment generation process, the access type 23 of the access log 1022 will be described as three types: “READ (read)”, “WRITE (write)”, and “DELETE (erase)”.

In S101, the simulation environment generation unit 128 provisionally creates an empty initial file configuration in the simulation file server 112 as a simulation file group 1121 by the processing device.
In S102, the simulation environment generation unit 128 temporarily creates simulation data 1112 by the processing device without changing the contents of the extraction log 122.
Thereafter, the simulated environment generation unit 128 accesses (operates) the provisionally created simulation file group 1121 according to the temporarily created simulation data 1112. At this time, for example, if there is no file to be read in the work area and there is no file to be read in the initial file structure, the simulated environment generation unit 128 performs processing such as adding a file to the initial file structure.

In S <b> 103, the simulated environment generation unit 128 copies the simulated file group 1121, which is an initial file configuration, to the work area of the simulated device 111 by the processing device. The simulated file group 1121 copied to the work area is referred to as a working simulated file group 11211.
In S104, the simulation environment generation unit 128 sets the analysis position of the simulation data 1112 to the first line by the processing device.
In S105, the simulation environment generation unit 128 analyzes one line of the analysis log that is the analysis position of the simulation data 1112 by the processing device.

In S106, the simulated environment generation unit 128 determines the access type 23 of the analysis log by the processing device.
In S106, if the access type 23 is READ, the simulated environment generation unit 128 proceeds to S107.
In S107, the simulation environment generation unit 128 determines whether there is a file to be read in the work simulation file group 11211 by the processing device. If there is a file to be read (YES in S107), the process proceeds to S108. If there is no file to be read (NO in S107), the process proceeds to S113.

In S106, if the access type 23 is WRITE, the simulated environment generation unit 128 proceeds to S110.
In S110, the simulated environment generation unit 128 creates a file to be written in the working simulated file group 11211. If there is already a file to be written, nothing is done. The simulated environment generation unit 128 proceeds to S108 after S110.

In S106, the simulated environment generation unit 128 proceeds to S111 if the access type 23 is DELETE.
In S111, the simulated environment generation unit 128 determines whether there is a file to be deleted in the working simulated file group 11211 by the processing device. If there is a file to be deleted (YES in S111), the process proceeds to S112.
In S112, the simulation environment generation unit 128 deletes the file to be deleted from the work simulation file group 11211 by the processing device.
If there is no DELETE file (NO in S111), the process proceeds to S113.

In S113, the simulation environment generation unit 128 determines whether there is a file to access the simulation file group 1121 of the simulation file server 112 by the processing device. If it is determined in S107 that there is no file to be read, the file to be read is determined as a file to be accessed. If it is determined in S107 that there is no file to be deleted, the file to be deleted is determined as a file to be accessed.

If the simulated environment generation unit 128 determines that there is no file to be accessed (NO in S113), the process proceeds to S115.
In S115, the simulation environment generation unit 128 adds a file for accessing the simulation file group 1121 of the simulation file server 112 by the processing device, returns to S103, and repeats the processing.

If the simulated environment generation unit 128 determines that there is a file to be accessed (YES in S113), the process proceeds to S114. The fact that there is a file that accesses the simulated file group 1121 of the simulated file server 112 means that the above inconsistency has occurred. For this reason, here, the corresponding line of the simulation data 1112 is changed to WRITE to eliminate the inconsistency.
In S114, the simulation environment generation unit 128 changes the access type 23 of the corresponding line (analysis log line) of the simulation data 1112 to WRITE, returns to S104, and repeats the processing.

In S108, the simulation environment generation unit 128 determines whether the simulation data 1112 has been analyzed to the last line by the processing device.
If it has not been analyzed to the end (NO in S108), the process proceeds to S109.
In S109, the simulation environment generation unit 128 advances the analysis position of the simulation data 1112 by one line, and repeats the processing from S105.
When the analysis is performed up to the last line (YES in S108), the simulated environment generation unit 128 ends the simulated environment generation process.

This is the end of the description of the simulated environment generation process performed by the simulated environment generation unit 128.
Here, the procedure generation unit 123 and the file generation unit 124 have been described as one simulated environment generation unit 128, but the procedure generation unit 123 and the file generation unit 124 may be separate processes. For example, the procedure generation unit 123 first temporarily creates a simulated file group 1121 as an initial file configuration on the work area, and ends the analysis for all the rows of the simulation data 1112. After the process of the procedure generation unit 123 is completed, the file generation unit 124 stores the simulation file group 1121 as the initial file configuration in the simulation file server 112 on the work area based on the simulation file group 1121 as the initial file configuration. It may be generated.
The process may be executed in any order and configuration as long as the difficulty of the training environment is adjusted based on the access log 1022 and the inconsistency that occurs when the operation is simulated can be resolved.

As described above, the simulation apparatus 111 and the information generation apparatus according to the present embodiment generate the simulation data 1112 by changing the number of users, for example, for the access log 1022 of the file server 102 of the production environment system 10. To do. At this time, the initial file structure of the simulation data 1112 and the simulation file group 1121 for the simulation system 11 is generated in response to the inconsistency in which data necessary for the simulation is missing. For this reason, it is possible to simulate the operational tendency of the production environment in a training environment having a configuration according to the target difficulty level without affecting the production environment system 10 and causing a load.

Generate simulation data for simulating production environment operation trends in the training environment without affecting the production environment, and simulating production environment operation trends in a training environment with a different configuration from the production environment The present invention can be applied to a system in which communication is performed between a plurality of clients such as a file server, a mail server, a Web server, an authentication server, and a DB server and the server.

Embodiment 2. FIG.
In the present embodiment, differences from the first embodiment will be mainly described.
Components having the same functions as those described in Embodiment 1 may be denoted by the same reference numerals and description thereof may be omitted.

In this embodiment, information names such as user names and file names appearing in the access log 1022 of the production environment system 10 are changed (anonymized) to names different from those of the production environment system 10. Further, the file name of the simulation file 1121a included in the simulation file group 1121 is changed (anonymized) to a name different from the file name of the file included in the file group 1021 of the production environment system 10.

The procedure generation unit 123 anonymizes the information name included in the log entry (operation history) of the access log 1022 by the processing device, and generates simulation data 1112 based on the access log 1022 in which the information name is anonymized. The procedure generation unit 123 may anonymize information names such as user names and file names that are confidential information.

The file generation unit 124 anonymizes the file name of the simulation file 1121a by the processing device, and generates the simulation file group 1121. The file generation unit 124 may anonymize when the file name is confidential information.

As described above, the simulation apparatus 111 and the information generation unit 1110 (information generation apparatus) according to the present embodiment generate simulation data and setting values in order to prevent leakage of confidential information in the production environment. Anonymize the confidential information of the production environment included in the log to be used, and generate data and setting values for simulating the operation tendency.
At the stage of retrieving the access log 1022 from the production environment system 10, the confidential information of the production environment system 10 is prevented from leaking to the simulation system 11 by changing (anonymizing) the name including such confidential information. And security of the production environment system 10 can be ensured.

Embodiment 3 FIG.
In the present embodiment, differences from the first and second embodiments will be mainly described.
Components having the same functions as those described in the first and second embodiments are denoted by the same reference numerals and description thereof may be omitted.

FIG. 9 is an overall configuration diagram of the production environment system 10 and the simulation system 11 according to the present embodiment. FIG. 9 is a configuration diagram when the simulation apparatus 111 is applied to a general mail server.

As shown in FIG. 9, the production environment system 10 includes a DNS (Domain Name System) server 602 and a mail server 603 in addition to the terminal group 101 and the network described in the first embodiment.

The DNS server 602 includes a DNS record 6021. The DNS server 602 is a server that performs name resolution between a domain name and an IP address by associating the domain name with an IP address. The DNS record 6021 stores associations between domain names and IP addresses.
The mail server 603 includes a transmission / reception log 6022. The transmission / reception log 6022 is an example of operation history information in which a history of mail transmission / reception, which is an operation from the terminal group 101, is accumulated.

The simulation system 11 simulates an operation tendency of mail transmission / reception from the terminal group 101 via the network 103 and the mail server 603 in the production environment system 10.
The simulation system 11 includes a simulation DNS server 612 and a simulation mail server 613 in addition to the simulation apparatus 111 and the simulation network 113 described in the first embodiment.
The simulation apparatus 111 includes simulation data 6112 and an external mail server 6111 in addition to the simulation terminal group 1111 described in the first embodiment.
The simulation DNS server 612 includes a simulation DNS record 6121. The simulation DNS record 6121 stores correspondence information between the domain name of the mail and the IP address.

The simulation system 11 generates simulation data 1112 indicating a mail transmission / reception procedure as a simulation procedure based on the transmission / reception log 6022. In the simulation system 11, the operation tendency of the terminal group 101 of the production environment system 10 is simulated by the simulation terminal group 1111 of the simulation system 11 in accordance with the contents of the simulation data 1112. The simulated terminal group 1111 transmits / receives mail to / from the external mail server 6111 via the simulation network 113 and the simulation mail server 613. The simulated terminal group 1111 transmits and receives mail within the simulated system 11.

At this time, in order to adjust the difficulty level of the training environment, the number of terminals and the number of users simulated by the simulation system 11 are different from those of the production environment system 10.
Further, in the simulation system 11 according to the present embodiment, an external mail server 6111 is prepared inside the simulation apparatus 111 in order to simulate mail transmission / reception with the outside of the system. When mail is transmitted from the simulated terminal group 1111 to the outside, the simulation DNS server 612 is set so that the mail is transmitted to the external mail server 6111. In addition, when receiving mail from the outside, transmission from the external mail server 6111 to the simulation mail server 613 simulates reception of mail from the outside.

FIG. 10 is a diagram showing an example of the configuration of simulation data 6112 according to the present embodiment.
The simulation system 11 simulates mail transmission / reception based on the simulation data 6112 and the simulation DNS record 6121.
In the simulation system 11, simulation data 6112 in which a transmission time 71, a transmission source address 72, a destination address 73, and the like are recorded, and a simulation DNS record for a simulation DNS server 612 for simulating mail transmission to an external environment 6121 needs to be prepared.

The simulation data 6112 includes a transmission time 71 indicating a transmission interval of a mail necessary for the operation of the external mail server 6111 and the simulated terminal group 1111, a transmission source address 72 that is a transmission source of the mail, a destination that is a transmission destination of the mail. Information such as an address 73 is stored. Thus, the simulation data 6112 stores data necessary for simulation.

In the simulation DNS record 6121 of the simulation DNS server 612, the correspondence between the domain name and the IP address is set so that name resolution for the mail addressed to the external environment transmitted from the simulation terminal group 1111 becomes the external mail server 6111. Information is set.
In the present embodiment, the external mail server 6111 and the simulated terminal group 1111 are configured on the simulated device 111, but the configuration is not limited thereto. For example, there is no problem even if the necessary number of servers and terminals are actually prepared, and the simulation of the operation tendency is performed using the simulation data 6112 prepared for each server and each terminal. Realization of the simulation method by the simulation apparatus 111 according to the present embodiment does not depend on the configuration of the simulation system 11 or the simulation apparatus 111 itself.

FIG. 11 is a block configuration diagram of the simulation apparatus 111 according to the present embodiment. FIG. 12 is an overall configuration diagram of the production environment system 10 and the simulation system 11 according to the present embodiment, and is a diagram for explaining the operation of each unit of the simulation apparatus 111.

As shown in FIGS. 11 and 12, the information generation unit 1110 generates simulation data 6112 and simulation DNS record 6121 based on the transmission / reception log 6022. A transmission / reception log 6022 of the mail server 603 is a general log output by the mail server 603 for auditing, failure analysis, or the like.

Similar to the first embodiment, the extraction unit 121 extracts a log record from the transmission / reception log 6022 based on the extraction condition 126 (extraction process 121a). Then, the simulation environment generation unit 128 generates simulation data 6112 and simulation DNS record 6121 (procedure generation process 123a (simulation data generation process), file generation process 124a (simulation DNS record generation process)).
The simulation data 6112 is an example of an operation procedure (email transmission / reception procedure). The simulation DNS record 6121 is an example of a simulation file that is a file used for simulation.

As described in the first embodiment, the procedure generation process 123a (simulation data 6112 generation process) by the procedure generation unit 123 and the file generation process 124a (simulation DNS record generation process) by the file generation unit 124 are different processes. Alternatively, the procedure generation unit 123 and the file generation unit 124 may be configured as one simulated environment generation unit 128 and may be one simulated environment generation process. That is, the simulation environment generation unit 128 outputs the setting values of the simulation data 6112 and the simulation DNS record 6121 from the transmission / reception log 6022.

First, in order to reduce the number of users simulated by the simulation system 11 from the production environment system 10, only the logs related to necessary users are extracted from the transmission / reception log 6031 by the extraction processing 121 ab by the extraction unit 121.
When mail is transmitted from a user in the production environment system 10 to a user in the production environment system 10, the transmission / reception log 6022 includes two logs, transmission and reception, for a single mail transmission. Will exist. However, when simulating the operation tendency of mail transmission / reception by the simulation system 11, since the mail transmission operation is generally simulated, the users are narrowed down by the source address.

There may be an inconsistency that the target user excerpt log 622 operates in a state where necessary data is missing due to the effect of narrowing down the target transmission users in the extraction process 121a. For example, there is a possibility that a user excluded as a sender exists as a receiver. If this transmission itself is simply excluded to cope with this, the number of transmissions to be simulated decreases.

FIG. 13 is a flowchart showing the operation of the simulated environment generation process performed by the procedure generation unit 123 and the file generation unit 124 according to the present embodiment.
In the simulated environment generation process S200 (simulation data, simulation DNS record generation process), the extracted log 122 extracted from the transmission / reception log 6022 is analyzed line by line, and the setting values of the simulation data 6112 and the simulation DNS record 6121 are analyzed. Is generated.

In S201, the simulation environment generation unit 128 sets empty simulation data 6112 by the processing device, and sets the analysis log that is the analysis position of the extraction log 122 as the first line.
In S202, the simulated environment generation unit 128 analyzes the analysis log of the extraction log 122 by the processing device.

In step S <b> 203, the simulated environment generation unit 128 determines whether the analysis log transmission source is within the production environment system 10 using the processing device.
When the transmission source is within the production environment system 10 (YES in S203), the simulated environment generation unit 128 proceeds to S204.
If the transmission source is not within the production environment system 10 (NO in S203), the simulated environment generation unit 128 proceeds to S209.
In S209, the simulated environment generation unit 128 associates the domain name of the transmission source with the IP address (hereinafter referred to as name resolution) so that the mail of the analysis log becomes a transmission mail from the external mail server 6111 by the processing device. Is added to the simulation DNS record 6121, and the process proceeds to S204.

In S <b> 204, the simulated environment generation unit 128 determines whether the destination of the analysis log is within the production environment system 10 using the processing device.
If the destination is not within the production environment system 10 (NO in S204), the simulated environment generation unit 128 proceeds to S210.
In S210, the simulation environment generation unit 128 associates the destination domain name with the IP address so that the analysis log destination is the external mail server 6111 in the simulation DNS record 6121 (hereinafter, name resolution). And the process proceeds to S207.

If the destination is within the production environment system 10 (YES in S204), the simulated environment generation unit 128 proceeds to S205.
In step S <b> 205, the simulated environment generation unit 128 determines whether the destination is an address excluded by the extraction unit 121 by the processing device. The simulated environment generation unit 128 determines whether the address is an address from which the destination is excluded by referring to the extraction condition 126, for example.

If the destination is not an excluded address (NO in S205), the process proceeds to S207.
If the destination is an excluded address (YES in S205), the process proceeds to S206.
In S206, the simulated environment generation unit 128 changes the destination address of the analysis log to an address of the internal environment that is not excluded by the processing device. As described above, when the destination of the extraction log 122 is an address of the internal environment, if the destination is the same as the transmission source address excluded in the extraction processing 121a, the destination is changed to an address that is not excluded. Ensure sex.

In S207, the simulation environment generation unit 128 adds the analysis log to the simulation data 6112 by the processing device.

In S208, the simulated environment generation unit 128 determines whether the extraction log 122 has been analyzed up to the last line by the processing device.
If it has not been analyzed to the end (NO in S208), the process proceeds to S211.
In S211, the simulated environment generation unit 128 advances the analysis position of the extraction log 122 by one line, and repeats the processing from S202.
When the analysis is performed up to the last line (YES in S208), the simulated environment generation unit 128 ends the simulated environment generation process (S212).

As described above, in the simulation system 11 and the simulation apparatus 111 according to the present embodiment, the number of transmission users is changed with respect to the transmission / reception log 6031 of the mail server 603 of the production environment system 10, and the data generated at that time is reduced. Simulating data 6112 and simulating DNS record 6121 are generated while coping with the matching. Accordingly, it is possible to simulate the operation tendency of the production environment in the training environment having a configuration according to the target difficulty level without affecting the production environment system 10 and the load.

Embodiment 4 FIG.
In the present embodiment, differences from the third embodiment will be mainly described.
Components having the same functions as those described in the third embodiment are denoted by the same reference numerals, and description thereof may be omitted.

In the present embodiment, the information name of the source address and destination address appearing in the transmission / reception log 6022 of the production environment system 10 is changed (anonymized) to a name different from that of the production environment system 10.
The simulated environment generation unit 128 (the procedure generation unit 123 and the file generation unit 124) anonymizes the information name of the transmission source address and the destination address included in the mail transmission / reception history of the transmission / reception log 6022 by the processing device, and the information name is anonymized. Based on the transmission / reception log 6022, simulation data 6112 and simulation DNS record 6121 are generated. The simulated environment generation unit 128 may anonymize information names such as a transmission source address and a destination address that are confidential information.

As described above, the simulation system 11, the simulation device 111, and the information generation unit 1110 (information generation device) according to the present embodiment change the names of confidential information and the like at the stage of extracting the transmission / reception log 6022 from the production environment system 10. Since anonymization is performed, it is possible to prevent the confidential information of the production environment system 10 from leaking to the simulation system 11 and to secure the security of the production environment system 10.

The configurations of the “information generation unit”, “simulated environment generation unit”, “execution unit”, “extraction unit”, “procedure generation unit”, and “file generation unit” described in the first to fourth embodiments are as follows. It is not limited. For example, the “procedure generation unit” and the “file generation unit” may be realized by one functional block, and the “simulated environment generation unit” and the “extraction unit” may be realized by one functional block. Alternatively, the simulation apparatus 111 may be configured by any other combination of these functional blocks.

Although the embodiments of the present invention have been described above, two or more of these embodiments may be implemented in combination. Alternatively, one of these embodiments may be partially implemented. Alternatively, two or more of these embodiments may be partially combined. In addition, this invention is not limited to these embodiment, A various change is possible as needed.

Embodiment 5 FIG.
In the present embodiment, differences from Embodiments 1 to 4 will be mainly described.
In the present embodiment, the same components as those described in the first to fourth embodiments are denoted by the same reference numerals, and the description thereof is omitted.

As described above, in the first to fourth embodiments, as a method of simulating and reproducing the operation tendency of the production environment system 10, the simulation system 11 that generates reproduction data from log data (see FIGS. 1, 5, 9, etc.) Explained. The simulation system 11 is aimed at, for example, SOC (Security Operation Center) training.

As described in the fourth embodiment, the simulation system 11 anonymizes log data from the access log 1022 and the transmission / reception log 6022 of the production environment system 10 and retrieves the log data. The simulation system 11 narrows down the scale of the user to be simulated in order to adjust the difficulty level, generates simulation data 1112 and 6112 as reproduction data so that no contradiction occurs during reproduction, and executes simulation. As described above, according to the simulation system 11 according to the fourth embodiment, it is possible to reproduce the operation tendency of the production environment system 10 in environments of different scales while ensuring security.

∙ An SOC training environment may be established for the purpose of training personnel to respond to cyber attacks. In this case, it is necessary to record and play back the cyber attack operation manually (instructor) after simulating the operational tendency of the production environment system 10. Furthermore, it is necessary to enable cyber attack detection training using log monitoring software.

This SOC training environment can be realized as follows by combining the simulation system 11 described in Embodiments 1 to 4 and a method for storing and reproducing operation records for the purpose of regression testing.
First, an attack operation record at the time of a cyber attack is stored in advance. Then, along with the simulation of the operation tendency of the production environment system 10, the attack operation record at the time of the cyber attack is reproduced to realize the training environment. The log monitoring software stores a log when the training environment is realized as a training log. Using the training log saved by the log monitoring software, the trainer conducts cyber attack detection training.

However, only by reproducing the simulation of the operation tendency of the production environment system 10 and the simulation of the cyber attack, the training effect for the trainer is weak. This is because the training environment becomes the same every time because the attacking terminal IP address used for the attack, the account name, the IP address, etc. of the infected terminal infected with the virus are the same every time.
On the other hand, in cases where cyber-attack detection has failed during past training, it may be desired to train again in the same training environment.

In the present embodiment, for example, an environment providing system 200 that can create a different training environment each time during training such as SOC training, and can return to the training environment saved at a certain point in time will be described.

FIG. 14 is an overall configuration diagram of an environment providing system 200 (environment providing apparatus) according to the present embodiment.
In the environment providing system 200 according to the present embodiment, a plurality of components having various functions are further added to the components of the simulation system 11 described in the first to fourth embodiments.

The environment providing system 200 includes a pseudo Internet environment system 210, a virtual enterprise environment system 220, and a test management environment system 230.

The pseudo Internet environment system 210 includes an attack terminal 212 and a server group 213. The server group 213 includes, for example, a Web server 2131 and a DNS server 2132. Further, an attack operation record 2312 described later is stored in the storage device provided in the pseudo Internet environment system 210.

The virtual enterprise environment system 220 includes a simulated terminal group 1111, a business system 223, and a log monitoring environment system 224. The simulated terminal group 1111 is an example of a training device used for cyber attack detection training.
The test management environment system 230 includes a training management device 231.

The training management device 231 of the test management environment system 230 includes a request acquisition unit 2316, a training execution unit 2315, and a training environment change unit 2313. The storage device of the training management device 231 stores a normal business scenario 2311, an attack operation record 2312, and training environment information 2314.

The normal business scenario 2311 is the simulation data 1112 (see FIG. 2) and the simulation data 6112 (see FIG. 11) described in the first to fourth embodiments. The normal business scenario 2311 (simulation data 1112 and 6112) is generated by the information generation unit 1110 (see FIGS. 2 and 11) as described in the first to fourth embodiments. In FIG. 14, the information generation unit 1110 is not shown, but the test management environment system 230 includes the information generation unit 1110. The information generation unit 1110 stores the generated normal business scenario 2311 (simulation data 1112 and 6112) in the storage device of the training management device 231.
The normal business scenario 2311 is an example of a simulation procedure.

The attack operation record 2312 stores at least one operation record at the time of a cyber attack. The attack operation record 2312 is an example of an attack procedure.
The training environment information 2314 stores past training environments. The training environment information 2314 is an example of an environment information storage unit that stores information indicating the training environment generated by the training environment change unit 2313 (environment setting unit).

When training is performed using the environment providing system 200 according to the present embodiment, first, an administrator (for example, an instructor) issues an environment setting request for requesting setting of a training environment for a training apparatus used for attack detection training. Entered.
The request acquisition unit 2316 acquires this environment setting request.
The environment setting request includes information related to selection of the normal business scenario 2311 and information related to selection of the attack operation record 2312.

In addition, the environment setting request includes the designation of whether to create a new training environment, keep the current training environment, or use the past training environment for the training environment when conducting the training. It is. Information specifying generation of a new training environment is called a generation instruction. As the past training environment, for example, a training environment in which attack detection has failed in the past may be specified, or a past date and time may be specified, and a training environment corresponding to the date and time may be specified.

The training execution unit 2315 transmits the normal business scenario 2311 selected by the environment setting request to the virtual enterprise environment system 220. The training execution unit 2315 causes the simulated terminal group 1111 (training apparatus) to perform simulation of the normal business of the production environment system 10 according to the normal business scenario 2311 (simulation procedure). The training execution unit 2315 is an example of a simulation execution unit.

Also, the training execution unit 2315 transmits the selected attack operation record 2312 to the pseudo Internet environment system 210. The attack terminal 212 of the simulated Internet environment system 210 performs a cyber attack on the simulated terminal group 1111 that is performing the simulation according to the attack operation record 2312 (attack procedure). The attack terminal 212 is an example of an attack execution unit.

The training environment changing unit 2313 newly sets a training environment when a new training environment is selected. When a training environment is newly set, the training environment change unit 2313 stores the set training environment in the training environment information 2314.
The training environment changing unit 2313 is an example of an environment setting unit that sets the training environment of the simulated terminal group 1111 based on the environment setting request.

The training environment changing unit 2313 determines whether or not a generation instruction for instructing generation of a training environment is included in the environment setting request. When it is determined that the generation instruction is included, the training environment change unit 2313 generates a training environment for the simulated terminal group 1111. The training environment changing unit 2313 sets the generated training environment in the virtual enterprise environment system 220 and the pseudo Internet environment system 210. In this manner, the training environment changing unit 2313 sets the training environment of the training device according to the generation instruction included in the environment setting request.

When the training environment changing unit 2313 determines that the generation instruction is not included in the environment setting request, the training environment changing unit 2313 sets the training environment information 2314 stored in the storage device in the virtual enterprise environment system 220 and the pseudo Internet environment system 210. It is determined whether or not a setting instruction for instructing is included in the environment setting request. When it is determined that the setting instruction is included, the training environment changing unit 2313 acquires the training environment information 2314 based on the setting instruction, and the training environment information indicated by the acquired training environment information is the virtual enterprise environment system 220 and the pseudo Internet. Set in environment system 210. Thus, the training environment changing unit 2313 sets the training environment of the training device according to the setting instruction included in the environment setting request.

The simulated terminal group 1111 of the virtual enterprise environment system 220 is assumed to have a scale of, for example, hundreds to thousands. The simulated terminal group 1111 includes a plurality of terminals 1131. An infected terminal 1131x exists among the plurality of terminals 1131.

The business system 223 of the virtual enterprise environment system 220 includes a simulation file server 112 and a simulation DNS server 612. In addition, a Web server 2201 and the like are included. As described in the first to fourth embodiments, the simulation file server 112 includes the simulation file group 1121. The simulation DNS server 612 includes a simulation DNS record 6121. The Web server 2201 includes a log 2202 in which, for example, a URL (Uniform / Resource / Locator) is recorded.

The log monitoring environment system 224 of the virtual enterprise environment system 220 includes a trainee terminal 2241 and a log collection monitoring unit 2242.
The log collection monitoring unit 2242 stores a training environment log realized by the attack operation record 2312 and the normal business scenario 2311 as a training log 2243. The trainer uses the trainer terminal 2241 to monitor the output by the log collection monitoring unit 2242 such as the training log 2243 and perform training for detecting a cyber attack.
The log collection monitoring unit 2242 acquires operation logs from the simulated terminal group 1111 during execution of simulation by the simulated terminal group 1111 (training apparatus) and during execution of cyber attack by the attack terminal 212 (attack execution unit). It is an example of a log acquisition part.

FIG. 15 is a diagram illustrating an example of the configuration of the normal business scenario 2311 according to the present embodiment.
The normal business scenario 2311 stores a plurality of log records that are operations of a plurality of normal business operations.
For each record of the normal business scenario 2311, a record number, a reproduction interval, an account to be used, an operation type, and auxiliary information for reproduction are set. Each terminal 1131 can simulate the operational tendency of the production environment system 10 by playing back only the records corresponding to the account previously assigned to the terminal 1131.

FIG. 16 is a diagram for explaining a normal business reproduction method by terminal 1131 according to the present embodiment.
The training execution unit 2315 gives the normal business scenario 2311 to each terminal 1131 of the simulated terminal group 1111 of the virtual enterprise environment system 220 in order to simulate the operation tendency of the production environment system 10 during the production operation. The scenario 2311 is reproduced.
As illustrated in FIG. 16, the terminal 1131 includes a scenario execution unit 1131a and account information 1131b. The account information 1131b stores the account information of the terminal itself.
The scenario execution unit 1131a acquires the normal business scenario 2311 and also acquires account information 1131b. Based on the account information 1131b, the scenario execution unit 1131a executes a record of the normal business scenario 2311 corresponding to the account of the own terminal in the normal business scenario 2311.

For example, in the first record of the normal business scenario 2311, the reproduction time interval is set to 10 seconds, the account to be used is SP63251, the operation type is file server access, and the auxiliary information for reproduction is set to file path 1. Therefore, the scenario execution unit 1131a of the terminal 1131 corresponding to the account SP63251 executes simulation of normal work based on the information set in the first record.

FIG. 17 is a diagram for explaining a reproduction method of a cyber attack by the attack terminal 212 and the infected terminal 1131x according to the present embodiment.
The training execution unit 2315 gives the attack operation record 2312 to the attack terminal 212 of the pseudo Internet environment system 210 and the infected terminal 1131x of the virtual enterprise environment system 220 in order to reproduce the cyber attack.

The attack operation record 2312 includes an attack operation record (infection operation) 2312a and an attack operation record (cyber attack) 2312b.
The attack operation record (infection operation) 2312a is information on an infection operation for infecting the terminal 1131 with a virus.
The training execution unit 2315 transmits an attack operation record (infection operation) 2312a to the terminal 1131 (infected terminal 1131x).

The attack operation record (cyber attack) 2312b is information relating to a cyber attack operation (file leakage, etc.) after the terminal 1131 is infected with a virus to become an infected terminal 1131x and remote control becomes possible.
The training execution unit 2315 transmits an attack operation record (cyber attack) 2312b to the attack terminal 212.

As shown in FIG. 17, in order to reproduce an action of infecting a virus on the infected terminal 1131x in S111, an application used at the time of infection needs to be installed on the infected terminal 1131x.

In the attack operation record (infection operation) 2312a, for example, infection operations shown in S112a, S112b, and S112x are recorded. The infected terminal 1131x reproduces the infection operation selected by the administrator from among them. In S112a, the infected terminal 1131x is infected with a virus by an operation of executing the mail attachment file. In S112b, the infected terminal 1131x is infected with a virus by an operation of downloading and executing software with a virus from an external site. In S112x, the infected terminal 1131x is infected with a virus by an operation of executing software without omission of update.

If the infected terminal 1131x is infected with a virus in S113, the attack terminal 212 can be remotely operated.
The attack terminal 212 includes a remote operation unit 2121. Based on the attack operation record (cyber attack) 2312b, the remote operation unit 2121 reproduces a cyber attack on the virtual enterprise environment system 220 via the infected terminal 1131x.

In the environment providing system 200 according to the present embodiment, in addition to the above-described reproduction of the attack operation record 2312 and the normal business scenario 2311, it is necessary to appropriately switch the training environment during training.

FIG. 18 is a diagram showing an example of the configuration of the training environment information 2314 according to the present embodiment.
In the training environment information 2314, a plurality of training environments are set. In the training environment information 2314, the training environment number indicating the training environment, the implementation date and time when the training environment was implemented, the IP address of the attacking terminal 212, the account of the infected terminal 1131x, and the IP address are set. In addition to these pieces of information, information that defines the training environment may be set. In the training environment information 2314, either an account or an IP address may be set.
In this way, the training environment information 2314 is associated with the generation date and time when the training environment is generated.

Here, the hardware configuration of the training management device 231, the attack terminal 212, the terminal 1131, and the infected terminal 1131x will be described. For example, the hardware configuration of the training management device 231, the attack terminal 212, the terminal 1131, and the infected terminal 1131x is the same as the hardware configuration of the simulated terminal group 1111 described in FIG.

In each of the training management device 231, the attack terminal 212, the terminal 1131, the infected terminal 1131x, and the log monitoring environment system 224, the functions described as “unit” can be realized by each device executing a program.

The program is normally stored in the external storage device 902, and is loaded into the main storage device 903 and sequentially read into the arithmetic device 901 and executed.
As described above, the program is a program that realizes the function described as “unit” shown in the block configuration diagram.
Further, an operating system (OS) is also stored in the external storage device 902. At least a part of the OS is loaded into the main storage device 903, and the arithmetic unit 901 executes the OS while “˜” shown in the block configuration diagram. The program that realizes the function of “part” is executed.
Information such as “normal business scenario”, “attack operation record”, “training environment information”, “training log”, and “account information” is also stored in the external storage device 902.

FIG. 19 is a flowchart showing a flow of an environment providing method (environment providing process) of the environment providing system 200 according to the present embodiment.

<Request acquisition process (process): S10>
In S10, the training management device 231 acquires an environment setting request by the request acquisition unit (request acquisition step (process)). An administrator such as an instructor or a training trainer inputs an environment setting request to the request acquisition unit to select a normal business scenario 2311 and an attack operation record 2312 as the background of the training environment, and also provides training environment information. 2314 is selected.

For example, the request acquisition unit 2316 displays a scenario selection screen that allows the administrator to select the normal business scenario 2311 and the attack operation record 2312 on the display device. The request acquisition unit 2316 causes the administrator to select the normal business scenario 2311 and the attack operation record 2312 using the scenario selection screen. In addition, the request acquisition unit 2316 displays a training environment selection screen for selecting whether to set a new training environment, a current training environment, or a saved training environment for the training environment. indicate. On the displayed training environment selection screen, the administrator selects whether to set a new training environment, a current training environment, or a saved training environment.

Setting a new training environment means that a new training environment is generated by the training environment changing unit 2313 and the generated training environment is set. The administrator can specify the conditions of the newly created training environment from the training environment selection screen.
Setting the current training environment means that the training is performed in the current training environment.
Setting the saved training environment means setting the training environment recorded in the training environment information 2314 by the training environment changing unit 2313 in the past. The administrator can specify the past date and time as the specified date and time on the training environment selection screen.

If it is selected in S11 to set the saved training environment, the process proceeds to S12.
If it is selected in S11 to set the current training environment, the process proceeds to S17 without doing anything.
If it is selected in S11 to set a new training environment, the process proceeds to S13.

<Environment setting process (process): S12 to S16>
In S12, the training environment changing unit 2313 acquires the training environment information 2314 corresponding to the specified date and time specified in S11, and sets the acquired training environment information 2314. For example, the training environment information 2314 is associated with the generation date and time when the training environment is generated. The training environment changing unit 2313 acquires an environment setting request including a specified date and time, and acquires training environment information 2314 corresponding to the specified date and time based on the specified date and time included in the environment setting request.

In S13, the training environment changing unit 2313 changes the IP address of the attack terminal within the specified range.
In S <b> 14, the training environment changing unit 2313 exchanges accounts and IP addresses between the infected terminal 1131 x and the arbitrary terminal 1131.
In S15, the training environment changing unit 2313 changes the account used by each terminal 1131.
In S16, the training environment changing unit 2313 updates the DNS data regarding the terminal 1131 whose account has been changed. The DNS data is updated by executing re-registration of the simulation DNS record 6121 of the simulation DNS server 612.

By exchanging accounts and IP addresses of the infected terminal 1131x and the arbitrary terminal 1131 as in the process of S14, the infected terminal 1131x can be switched without installing an application necessary for infection in all the terminals 1131.
By the processes of S11 to S16, the environment providing process (process) for providing the training environment is completed.

<Simulation execution process (process), attack execution process (process): S17 to S18>
In S17, the training execution unit 2315 transmits the selected normal business scenario 2311 to the simulated terminal group 1111 and distributes the selected attack operation record 2312 to the infected terminal 1131x and the attack terminal 212.

In S <b> 18, the simulated terminal group 1111 and the attacking terminal 212 start simulation of normal business based on the normal business scenario 2311 and start simulation of cyber attack based on the attack operation record 2312.
In S19, training is performed by the trainee.

In S20, the training environment changing unit 2313 determines whether or not the current training environment has been saved in the training environment information 2314 by the processing device.
If it is determined in S20 that the current training environment has been saved in the training environment information 2314 (not required in S20), the process ends.
If it is determined in S20 that the current training environment is not stored in the training environment information 2314 (required in S20), the process proceeds to S21.
In S21, the training environment changing unit 2313 stores the current training environment in the training environment information 2314, and ends the process.

As described above, according to the environment providing system 200 according to the present embodiment, for example, when the SOC training environment is constructed, the training environment such as the attacker terminal IP, the account of the infected terminal, the IP, etc. Can change. Moreover, according to the environment provision system 200, it is possible to restore and train a training environment that has been implemented in the past. Therefore, the effect of training can be enhanced.
In addition, the training environment can be changed before the start of training (select a new training environment, a current training environment, or a training environment previously implemented), and the training environment can be saved for reuse after training. .

Each of the virtual enterprise environment system 220, the pseudo Internet environment system 210, and the test management environment system 230 described in the fifth embodiment may be a single device. Or it may not be one apparatus. You may be comprised from the several apparatus connected to the network. The virtual enterprise environment system 220, the pseudo Internet environment system 210, and the test management environment system 230 may be configured in any manner as long as the functions described above can be realized.

Although the first to fifth embodiments of the present invention have been described above, two or more of these embodiments may be implemented in combination. Alternatively, one of these embodiments may be partially implemented. Alternatively, two or more of these embodiments may be partially combined. In addition, this invention is not limited to these embodiment, A various change is possible as needed.

10 production environment system, 11 simulation system, 21 access time, 22 access user, 23 access type, 24 access file, 101 terminal group, 102 file server, 103 network, 111 simulation device, 112 simulation file server, 113 simulation network , 121 extraction unit, 121a extraction process, 122 extraction log, 123 procedure generation unit, 123a procedure generation process, 124 file generation unit, 124a file generation process, 125 execution unit, 126 extraction conditions, 128 simulated environment generation unit, 200 environment provision System, 210 pseudo Internet environment system, 212 attack terminal, 213 server group, 220 virtual enterprise environment system, 223 business system, 224 log monitoring environment system, 23 Test management environment system, 231 training management device, 602 DNS server, 603 mail server, 612 simulation DNS server, 613 simulation mail server, 901 arithmetic device, 902 external storage device, 903 main storage device, 904 communication device, 905 input Output device, 1021 file group, 1022 access log, 1110 information generation unit, 1111, simulated terminal group, 1112, simulated data, 1121 simulated file group, 1121a simulated file, 1131, terminal, 1311, scenario execution unit, 1311, account information, 1311, infected terminal 2121 Remote operation unit, 2131 Web server, 2132 DNS server, 2201 Web server, 2241 trainer terminal, 2242 log collection monitoring unit, 2243 training log 2311 Normal business scenario, 2312 Attack operation record, 2312a Attack operation record (infection operation), 2312b Attack operation record (cyber attack), 2313 Training environment change part, 2314 Training environment information, 2315 Training execution part, 2316 Request acquisition part, 6021 DNS record, 6022 transmission / reception log, 6111 external mail server, 6112 simulation data, 6121 simulation DNS record.

Claims (20)

1. An extraction unit that extracts a plurality of operation histories as extraction operation histories from the operation history information based on an extraction condition that is a condition for extracting operation histories from operation history information in which a plurality of operation histories indicating operation histories are accumulated;
   Based on the extraction operation history extracted by the extraction unit, a procedure generation unit that generates a simulation procedure indicating a procedure of the operation to be simulated by a processing device;
   A simulation apparatus comprising: an execution unit that executes the simulation procedure generated by the procedure generation unit using a processing device.
2. The procedure generator is
   Correcting at least one operation history among the plurality of operation histories so as to eliminate inconsistency between operation histories generated when the plurality of operation histories included in the extraction operation history are simulated, and The simulation apparatus according to claim 1, wherein the extraction operation history in which the operation history is corrected is used as the simulation procedure.
3. In the operation history information, a plurality of operation histories for files are accumulated as the operation history,
   The simulation apparatus further includes:
   Based on the simulation procedure, a file generation unit that generates a simulation file that is an operation target indicated by the simulation procedure,
   The execution unit is
   The simulation apparatus according to claim 1, wherein the simulation procedure is executed on the simulation file generated by the file generation unit.
4. The procedure generator is
   The information procedure included in the operation history of the extraction operation history is anonymized by a processing device, and the simulation procedure is generated based on the extraction operation history in which the information name is anonymized. 4. The simulator according to any one of items 3 to 3.
5. The file generator
   The simulation apparatus according to claim 3, wherein a file name of the simulation file is anonymized by a processing apparatus.
6. The operation history includes an identifier for identifying an operator who performed the operation,
   6. The simulation apparatus according to claim 1, wherein the extraction unit uses a preset identifier as the extraction condition, and extracts an operation history including the identifier from the operation history information.
7. The simulation apparatus according to claim 4, wherein the information name is confidential information.
8. The simulation apparatus according to claim 5, wherein the file name is confidential information.
9. In the operation history information, a plurality of mail communication histories performed via a mail server are accumulated as the operation history,
   The simulation apparatus further includes:
   A communication source server and a communication destination server that perform mail communication indicated by the simulation procedure based on the simulation procedure,
   The execution unit is
   The simulation apparatus according to claim 1, wherein the simulation procedure is executed using the communication source server and the communication destination server.
10. An extraction unit that extracts a plurality of operation histories as extraction operation histories from the operation history information based on an extraction condition that is a condition for extracting operation histories from operation history information in which a plurality of operation histories indicating operation histories are accumulated;
    Based on the extraction operation history extracted by the extraction unit, a procedure generating unit that generates a simulation procedure indicating a procedure of an operation to be simulated as information used for the simulation of the operation, and
    The procedure generator is
    Correcting at least one operation history among the plurality of operation histories so as to eliminate inconsistency between operation histories generated when the plurality of operation histories included in the extraction operation history are simulated, and The information generation apparatus characterized in that the extraction operation history whose operation history is corrected is used as the simulation procedure.
11. In the operation history information, a plurality of operation histories for files are accumulated as the operation history,
    The information generation device further includes:
    The file generation part which produces | generates the simulation file used as the object of operation which the said simulation procedure shows based on the said simulation procedure as information used for the simulation of the said operation is provided. Information generator.
12. Based on an extraction condition that is a condition for extracting an operation history from operation history information in which a plurality of operation histories indicating operation histories are accumulated, a plurality of operation histories are extracted as extraction operation histories from the operation history information,
    Based on the extracted extraction operation history, a simulation procedure indicating an operation procedure to be simulated is generated by the processing device,
    A simulation method, wherein the generated simulation procedure is executed by a processing device.
13. An extraction process for extracting a plurality of operation histories from the operation history information as an extraction operation history based on an extraction condition that is a condition for extracting an operation history from operation history information in which a plurality of operation histories indicating operation histories are accumulated;
    On the basis of the extraction operation history extracted by the extraction process, a procedure generation process for generating a simulation procedure indicating a procedure of an operation to be simulated by a processing device;
    A simulation program for causing a computer to execute an execution process of executing the simulation procedure generated by the procedure generation process by a processing device.
14. An environment setting unit that sets the training environment of the training device in the training device based on an environment setting request that requires setting of the training environment of the training device used for attack detection training;
    According to a simulation procedure, a simulation execution unit that causes the training device to execute simulation,
    An environment providing system comprising: an attack execution unit that executes a cyber attack on the training device that is performing simulation according to an attack procedure.
15. The environment setting unit
    It is determined whether or not the environment setting request includes a generation instruction for instructing generation of a training environment for the training apparatus. If it is determined that the generation instruction is included, a training environment for the training apparatus is generated. And setting the generated training environment in the training device,
    The environment providing system according to claim 14, further comprising an environment information storage unit that stores environment information indicating the training environment generated by the environment setting unit.
16. The environment setting unit
    When it is determined that the generation instruction is not included in the environment setting request, a setting instruction that instructs to set the training environment indicated by the environment information stored in the environment information storage unit in the training apparatus is It is determined whether or not it is included in the environment setting request, and when it is determined that the setting instruction is included, the environment information is acquired from the environment information storage unit based on the setting instruction, and the acquired environment The environment providing system according to claim 15, wherein a training environment indicated by information is set in the training device.
17. The environmental information storage unit
    Storing the environment information associated with the generation date and time of generating the training environment of the training device;
    The environment setting unit
    17. The environment according to claim 16, wherein the environment setting request including a specified date and time is acquired, and the environment information is selected from the environment information storage unit based on the specified date and time included in the environment setting request. Offer system.
18. 18. A log acquisition unit that acquires an operation log from the training device during execution of simulation by the simulation execution unit and execution of an attack by the attack execution unit. The environment providing system according to any one of the above.
19. The environment setting unit sets the training environment of the training device in the training device based on the environment setting request for requesting the setting of the training environment of the training device used for attack detection training,
    The simulation execution unit causes the training apparatus to execute simulation according to a simulation procedure,
    An environment providing method, wherein an attack execution unit executes a cyber attack on the training device that is executing simulation according to an attack procedure.
20. An environment setting process for setting the training environment of the training device in the training device based on an environment setting request for requesting the setting of the training environment of the training device used for attack detection training;
    A simulation execution process for causing the training apparatus to execute a simulation according to a simulation procedure;
    A program for executing an attack execution process for executing a cyber attack on the training apparatus that is executing the simulation according to an attack procedure.

Images