WO2016199582A1

WO2016199582A1 - Cyberattack countermeasure range prioritizing system, and cyberattack countermeasure range prioritizing method

Info

Publication number: WO2016199582A1
Application number: PCT/JP2016/065539
Authority: WO
Inventors: 直樹下間; 林　直樹; 倫宏重本; 哲郎鬼頭; 仲小路　博史; 淳弥楠美
Original assignee: 株式会社日立システムズ
Priority date: 2015-06-10
Filing date: 2016-05-26
Publication date: 2016-12-15
Also published as: JP6490502B2; JP2017004233A

Abstract

The present invention makes it possible for countermeasures against various types of malware, including malware introduced by file manipulation, to be deployed efficiently. This cyberattack countermeasure range prioritizing system is formed from a plurality of constituent elements, prioritizes a range over which countermeasures against constituent elements infected by malware are to be deployed, and is provided with a countermeasure range prioritizing portion which: acquires characteristic information indicating characteristics of the malware with which constituent elements have been infected; calculates, on the basis of relationship information which indicates relationships between constituent elements and is stored in a storage portion, and also on the basis of the characteristic information, the distance between the constituent elements of a malware infection type indicated in the characteristic information, and the infected constituent elements; and defines countermeasure range priority levels on the basis of policy information associating the calculated distance with a prioritization policy indicating the countermeasure range.

Description

Cyber attack countermeasure range prioritization system, cyber attack countermeasure range prioritization method

The present invention relates to a system for prioritizing the scope of countermeasures when countermeasures against malware infection are confirmed in an organization such as a company.

In recent years, cyber attacks targeting corporations using suspicious file attachment type attack emails (suspicious emails) are increasing. Among these, security managers handle a large number of suspicious emails and suspicious sample reports every day, and detect, analyze, and respond to suspicious emails (identification of targets suspected of malware infection, identification of infection range, caution) Aroused).

When a malware infection is detected, the security administrator investigates whether there is any other infected device in the company based on the infected device, and takes measures such as isolating the infected device's network and adding a proxy blacklist. There is a need (these surveys and countermeasures are collectively referred to as countermeasures).

However, in order to implement the above measures in a large company with a large number of employees, the number of terminals, file access logs, and network logs to be surveyed becomes enormous, which is troublesome. Become.

There is Patent Document 1 (“Virus Damage Range Prediction System”) as a technology related to the above-described reduction in labor required for specifying the range of countermeasures against malware infection. Patent Document 1 stores the operation log of each client terminal every day, and when an infection of the client is detected, specifies the file operated by the client from the operation log and specifies another client that has accessed the file By doing so, we identify the range of possible infections in the entire network system and raise the priority of countermeasures. And it is a technique that reduces the effort required to identify the infection range by investigating from a high priority range.

JP 2009-176137 A

There are various types of malware infection methods such as infection by file operations, infection by e-mail, and infection by browsing websites. However, since the technique described in Patent Document 1 does not perform anything other than specifying the countermeasure range based on the file operation log, it cannot cope with malware other than infection caused by file operations.

The present invention has been made in view of the above, and a cyber attack countermeasure range prioritizing method and a cyber attack countermeasure range prioritizing method capable of efficiently performing countermeasures against various malware including file operations. The purpose is to provide.

In order to solve the above-mentioned problems and achieve the object, the cyber attack countermeasure range prioritizing system according to the present invention is composed of a plurality of components, and cyber attack countermeasures prioritize the countermeasure range for components infected with malware. A range prioritizing system that acquires characteristic information indicating characteristics of the malware that has infected the constituent elements, and includes relation information indicating the relation between the constituent elements stored in a storage unit and the characteristic information. Based on the infection type of the malware indicated in the characteristic information, the distance between the component and the infected component is calculated, and the calculated distance is associated with the prioritization policy indicating the countermeasure range A cyber attack characterized by comprising a countermeasure range prioritizing section for determining the priority of the countermeasure range based on policy information Configured as a countermeasure range prioritization system.

Also, the present invention can be understood as a cyber attack countermeasure range prioritization method performed by the cyber attack countermeasure range prioritization system.

According to the present invention, it is possible to efficiently take measures against various malware including file operations.

1 is an overall configuration diagram of a system. It is an example of a system configuration diagram. It is an example of a structure of attribute information DB. It is an example of a structure of the mail exchange relation information table of relation information DB. It is an example of a structure of the exchange relationship information table of SNS of relationship information DB. It is an example of a structure of the exchange relation information table between the business departments of relation information DB. It is an example of a structure of countermeasure range prioritization policy DB. It is an example of a structure of operation characteristic information DB. It is an example of a structure of countermeasure log | history information DB. It is an example of the whole outline | summary flow of relationship information DB creation / update. It is an example of the whole outline flow of countermeasure range prioritization. It is an example of the detailed flow of relation information DB creation and update. It is an example of a countermeasure range prioritization detailed flow. It is an example of a structure of countermeasure range prioritization policy DB applicable to Example 2. FIG. It is an example of the countermeasure range prioritization detail flow applicable to Example 2. FIG.

Hereinafter, embodiments of the present invention will be described based on examples shown in the drawings. The embodiment is not limited to the following.

First, an overall configuration diagram of a cyber attack countermeasure range prioritizing system to which the present invention is applied will be described with reference to FIG. The cyber attack countermeasure range prioritization system 101 includes, as components, a relation information DB (Data Base) 102, a countermeasure range prioritization policy DB 103, an attribute information DB 104, an operation characteristic information DB 105, a countermeasure range history information DB 106, a relation information creation / An update function 107 and a countermeasure range prioritizing function 108 are provided.

The cyber attack countermeasure range prioritization system 101 acquires configuration information (such as owner information and IP information of a terminal) of the infected client terminal 109 when the client terminal 109 of a certain organization confirms malware infection.

Also, the result of analyzing the behavior and operation characteristics of the malware operating on the client terminal 109 by the malware analysis function 110 is stored in the operation characteristic information DB 105. The cyber attack countermeasure range prioritization system 101 also acquires a communication log from the mail server 111, the network device 112, etc. generated in daily business processing of the organization, and the related information creation / update function 107 Information relating to the relationship between the client terminals 109 is generated using the attribute information DB 104 and the relationship information DB 102 and stored in the relationship information DB 102. The contents of this process will be described below.

When a malware infection is confirmed at a client terminal 109 in the organization, the cyber attack countermeasure range prioritization system 101 determines whether the configuration information of the infected client terminal, the operation characteristic information of the malware, and the client terminal 109 in the organization Using the relationship information, the prioritization of the countermeasure range of malware infection is calculated, and the list information of the calculation result is output to the countermeasure execution function 113. Based on the acquired list information, the countermeasure implementation function 113 sends a countermeasure implementation countermeasure (such as sending an alert mail to a client terminal having a high possibility of infection in addition to the infected client terminal 109). Transmit to terminal 114.

The system can be realized by a normal computer system as shown in FIG. Specifically, it includes a CPU 201, a memory 202, a storage device 203, an input device 204, an output device 205, a communication control device 206, and a bus 207 that connects these components to each other. The CPU 201 executes various programs stored in the storage device 203 and expanded in the memory 202. The input device 204 is, for example, a keyboard or a mouse, and the output device 205 is, for example, a display. The communication control device 206 is, for example, a wireless network interface or a network interface card. These are connected to each other by a bus 207. Each of the following functions (relation information creation / update function 107, countermeasure range prioritizing function 108, countermeasure implementation function 113) is actually a general information processing apparatus such as a server or a PC (Personal Computer). Each of the above functions is realized by executing a program that operates as a relation information creating / updating unit, countermeasure range prioritizing unit, and countermeasure implementing unit installed in the system.

In this system, the attribute information DB 104 and the countermeasure range prioritizing policy DB 103 are stored as input information in advance for each company. The attribute information is information for uniquely identifying each component of the system. If the component is a person, it is an employee ID, name, department, position, email address information, etc. For departmental organizations, there are department names, business divisions, and location information.

In the countermeasure range prioritization policy information, when a component infected with malware is detected in the network system of the organization, which range is set as the possible range of infection, and what priority is set as the priority of the countermeasure It is information that determines.

Also, the relationship information DB 102 holds information on the relationship between each component of the organization from the log information indicating the history of processing and operations performed in daily operations of the organization. As for the relationship information, if the constituent elements are employees of the organization and the log information is an email transmission / reception log, there is an email exchange relationship between employees. If the constituent element is an employee and the log information is a message transmission / reception log in SNS, there is an exchange relationship between employees.

The relationship information may be the email exchange layer, the SNS layer, or the packet communication layer between components. In addition to employees, the constituent elements may be business departments, computer terminals, information systems composed of a plurality of terminals, network segments, and the like. Further, the relationship information DB 102 can take a plurality of table structures depending on the relationship between the constituent elements. For example, there is a table structure that holds the exchange relationship of the mail between components, and a table structure that holds an exchange relationship between employees in the SNS.

Then, the operation characteristic information DB 105 and the countermeasure history information DB 106 are held not as input information unique to the organization, but as information acquired when implementing malware infection countermeasures in the organization or information obtained from outside the organization. Malware operating characteristic information includes malware characteristic information and information on operating environment conditions. In addition, the countermeasure history information includes what countermeasures have been taken against what malware in the past malware countermeasure examples, and policy information for future countermeasures.

In the following, the contents of each DB will be described. First, the configuration of the attribute information DB 104 will be described with reference to FIG. The attribute information DB 3301 holds individual information of all employees belonging to the company targeted by the system of the present embodiment. Specifically, the attribute information DB 3301 includes an employee ID 3302, an e-mail address 3303, a name 3304, an office name 3305, a department name 3306, a department classification 3307, a position 3308, an owned terminal IP address 3309, an OS 3310, a browser 3312, a Word 3313, and a final login. It consists of date 3314.

The employee ID 3302 holds information for uniquely identifying each employee in the company. The e-mail address 3303 holds e-mail address information individually assigned to each employee. The name 3304 holds information on the name of the employee. The establishment name 3305 holds information on the establishment name to which the employee belongs. The department category 3307 holds business category information of the department to which the employee belongs. The position 3308 holds information on the position of the employee. The owned terminal IP address 3309 holds information on the IP of the terminal owned by the employee. The OS 3310 holds information on the OS of the terminal owned by the employee. The browser 3311 holds information on a browser used on the terminal owned by the employee. Word 3313 is an example of an application installed in the terminal owned by the employee, and holds the name and version information of the application. The last login date and time 3314 holds information on the last date and time when the employee logged in from the owned terminal.

For example, the mail address 3303 of the employee ID 3302 of “001” and the name 3304 of “Hanako” is “Hanako@aaa.com”. Because the name of the business establishment 3305 is “AAA” and the job title 308 is “business establishment manager”, the department name 306 is “-(not applicable)” and the department category 307 is also “-(not applicable). ) ”. Also, one terminal is owned, the owned terminal IP address 308 is “10.0.0.1”, the OS 310 is “Win7”, the browser 311 is “IE9”, and among the installed applications, Word312 Is “Office 2013”, and the last login date and time 313 at the owning terminal is “2015/01/01”.

Note that the individual employee information stored in the attribute information DB 301 is not limited to the above, and may be location information of a department, network segment information, age information, or the like. In this example, the attribute information DB 104 when the constituent element is an employee has been described. However, the structure of the attribute information DB 104 changes depending on whether the constituent element is a department or an information system.

Next, the configuration of the relational information DB 102 is shown using the tables 401, 411, and 421 of FIGS. 4 (a) to 4 (c).

First, the mail exchange relation information table 401 shown in FIG. 4A will be described. The mail exchange relation information table 401 holds information on the relationship between other employees of the organization and other employees and persons outside the company who are involved in the exchange of mails in daily operations.

Specifically, the exchange relation information table 401 with the mail includes an employee ID 402 and related person information 403. The employee ID 402 holds information that uniquely identifies each employee of the company. The related person information 403 holds information on an employee ID of a person who is in an email exchange relationship in the daily work of the employee if the employee is an employee and an e-mail address of the person if the employee is an external person. As a person related to the employee, whether or not the determination criteria for holding information related to the person in the related person information 403 has been sent or received an email more than a certain number of times, or has an email sent from the employee There are things.

For example, regarding an employee whose employee ID 402 is “002”, a person who is in an email exchange relationship with the employee has two employees having employee IDs 402 “023” and “030” and an email address. Is a person outside the company with “Jiro@abc.com”.

Similarly, in the SNS exchange relation information table 411 shown in FIG. 4B and the exchange relation information table 421 between business departments shown in FIG. 4C, for example, the employee ID 412 is “002”. The related persons in the exchange relationship are two persons having employee IDs 412 “001” and “030” from the related person information 413 and an outside person whose mail address is “Taro@abc.com”. I understand. For example, if the business unit signature 422 is related to “AAA / CC” (the AAA business unit CC unit), the business unit signature 422 is obtained from the related business unit information 423. It can be seen that the business department is “AAA / BB” (the BB department of the AAA division).

Next, the configuration of the malware operating characteristic information DB 601 will be described with reference to FIG. The operation characteristic information DB 601 holds information regarding malware detected in the organization or information regarding malware provided from outside the organization.

Specifically, the operation characteristic information DB 601 includes a malware ID 602, a hash value 603, an SNS 604, an e-mail 605, an OS 606, a browser 607, a Word 608, a timed expression 609, and the like. In addition, the information held in the operation characteristic information DB 601 may be information on the scan result of anti-virus software or information on the result of malware surface analysis.

The malware ID 602 holds information for uniquely identifying a certain malware. The hash value 603 holds information on the hash value of the malware. The SNS 604 and the mail 605 hold information indicating whether or not the malware is a type in which infection spreads via the SNS or mail. That is, the infection type of malware is determined by whether or not the infection spreads by the exchange between the constituent elements. In FIG. 6, it is shown that Yes is set when infection is expanded by SNS or mail, and No is set when it is not expanded.

The OS 606, the browser 607, and the Word 608 hold information indicating whether the malware is a type in which the malware operates in any version of the application or OS of the item. The time expression 609 holds information on whether or not the malware is of a type that operates at a specific date and time, and the date and time information.

Next, the configuration of the countermeasure range prioritization policy DB 108 will be described with reference to FIG. The countermeasure range prioritizing policy DB 501 holds policy information for prioritizing a range to be preferentially countermeasured when a component infected with malware (infected component) is detected in the organization.

Specifically, the countermeasure range prioritization policy DB 501 includes a countermeasure range classification element 502, a distance 503 from an infection component (in a mail exchange relationship), a position 504, a relationship between a last login date and a malware operation date 505. The countermeasure range prioritization policy 506 and the like.

The countermeasure range classification element 502 holds information on each classification element that is an axis for classifying the constituent elements of the organization when the constituent elements infected with malware in the organization are detected. In the following description, the components are assumed to refer to employees of the organization.

The distance 503 from the infection component (in the mail exchange relationship), which is one of the countermeasure range classification elements 502, is based on the infection component in the mail exchange relationship information table 401 in the relation information DB 102. When the constituent elements of the related party in the related party information 403 are traced, the calculated number of the constituent elements is reached through the shortest number of constituent elements.

Here, the component is “terminal”, and when calculating the distance, the number of other components between the infected component and the component in the “mail exchange relationship” is treated as the distance. It is assumed that each table in the relationship information DB 102 is defined. Further, in each table, when other components cannot be reached from the infected component to the component, the distance between the infected component and the component is “∞ (infinite)”. The definition of the distance is one example in the present embodiment, and is not limited to this.

The position 504 holds the position information of the owner of the terminal, which is the component. The relationship 505 between the last login date and the malware operation date and time is a time series comparison between the last date and time when the employee as the component logged in to the owned terminal and the operation date and time information of the malware described in the operation characteristic information DB 601. Holds relationship information. The countermeasure range prioritization policy 506 holds countermeasure priority information assigned to the component. In this embodiment, the priority is higher as the distance from the infection component is closer, and is lower as the distance is longer. When the distance is “∞ (infinity)”, the priority is “0”. However, even when the distance is long, the priority level changes depending on the information of other elements of the countermeasure range classification element. Further, the countermeasure range prioritization policy DB 501 is applied when prioritizing all the components in the organization. The setting of the priority is an example and is not limited to this.

For example, when a malware infection is detected on a terminal of a business establishment in a certain organization, the owner of the terminal can be regarded as a component. In addition, it is assumed that the operation date / time of malware in this example is “2014/12/1”, and the last login date / time to the terminal of the office manager is “2014/12/31”. At this time, the countermeasure range prioritization policy DB 501 can be viewed as follows. That is, since the component is an infection component, the distance 503 from the infection component (in the mail exchange relationship) in the countermeasure range classification element 502 is “0”, and the position 504 of the component is “business The line of “malware operation date and time ≦ last login date and time” corresponds to the relationship between the “manager”, the last login date and the malware operation date and time. At this time, it is understood from the countermeasure prioritization policy 506 that “3” is assigned as the priority of the countermeasure for the component.

Next, the configuration of the countermeasure history information DB 106 will be described with reference to FIG. The countermeasure history information DB 701 holds malware characteristic information, information on the infection range, future countermeasure policy information, and the like. Specifically, the countermeasure history information DB 701 includes malware characteristic information 702 having a hash value 703, a file name 704, and the like, past countermeasure history information = future countermeasure policy information 705, and the like. The malware characteristic information 702 holds malware characteristic information including a malware hash value 703 and a file name 704. In addition, past countermeasure history information⇒future countermeasure policy 705 includes information on which range of malware infection has been confirmed in the past, information on which range of components will be assigned countermeasure priority in the future, and the like. Hold.

Based on each of the above DBs, the system of this embodiment prioritizes the range of malware infection countermeasures in the target organization.

Hereinafter, the overall processing outline of the cyber attack countermeasure range prioritization system 101 to which the present invention is applied will be described in accordance with the overall processing flow as shown in FIGS. 8 (a) and 8 (b). In the system of the present embodiment, the relationship information DB creation / update process shown in FIG. 8A and the countermeasure range prioritization process shown in FIG. 8B operate independently.

In the relationship information DB creation / update process, the network communication log of the mail server 111, the network device 112, etc. is acquired, and the relationship information DB is created / updated. In the countermeasure range prioritization process, when an infection component is detected in the organization, information on the infection component is acquired, and the attribute information DB 104, the relationship information DB 102, the countermeasure range prioritization policy DB 103, the operation characteristics are acquired. Based on the information in the information DB 105 and the countermeasure history information DB 106, priority is given to the countermeasure range of malware infection in the organization. Hereinafter, the two processing contents will be described.

First, the outline of the processing flow for creating / updating the relational information DB by the relational information creation / updating function 107 will be described with reference to FIG.

In the overall overview flow of creating and updating the relationship information database, log information that occurs daily in the business of the organization (network system log information such as mail transmission / reception logs and other network communication logs, or file system access) Log information such as logs) is acquired (step 801).

Next, based on the acquired log information, it is determined which type of relation information DB 102 is to be created / updated (step 802).

Then, a creation / update process is performed on the determined relationship information DB 102 (step 803), thereby ending the entire overview flow of the relationship information DB creation / update. Details of this processing will be described later.

Next, an outline of the processing flow of countermeasure range prioritization processing by the countermeasure range prioritizing function 108 will be described with reference to FIG.

In the overall outline flow of the countermeasure range prioritization, first, information on the component that detected the malware infection (for example, the IP address of the owning terminal if the component is the terminal owner) is received (step 811).

Next, based on the acquired component information, prioritization of the scope of measures in the organization is performed (step 812). Details of this processing will be described later.

Next, the countermeasure range obtained in step 812 (for example, a list of IP addresses of terminals to be investigated with increasing priority) is used as input information to the countermeasure implementation function different from the system of this embodiment. By transmitting (step 813), the overall outline flow of the countermeasure range prioritization is completed.

The above is the overall processing overview of the relationship information DB creation / update processing and countermeasure range prioritization processing in the system of this embodiment.

Next, the details of the relation information DB creation / update process in step 802 will be described according to the process flow shown in FIG. In the present embodiment, a mail transmission / reception log from the mail server 111 will be described as an example of acquired log information.

In the detailed flow of the relation information DB creation / update, it is determined from the mail transmission / reception log acquired from the mail server 111 operated in a certain organization whether or not the person of the transmission source and the transmission destination is an employee. Or the process which memorize | stores the degree of the relationship between an employee and an external person in relation information DB102 is demonstrated. In this processing flow, the mail reception log of the mail server 111 is acquired.

First, a transmission destination mail address is extracted from the acquired mail reception log (step 901), and using the transmission destination mail address as a key, the attribute information DB 102 of the organization is searched for whether or not the corresponding employee exists (step 901). 902).

If, as a result of the above search (step 902), the corresponding employee does not exist in the organization, the related information DB creation / update process of this detailed flow is terminated. If the corresponding employee exists in the organization, the process proceeds to step 904 (step 903).

Next, the sender mail address is extracted from the acquired mail reception log, and the attribute information DB 102 of the organization is searched for the corresponding employee using the sender mail address as a key (step 904).

As a result of the search (step 904), if the corresponding employee does not exist in the organization, the process proceeds to step 906. If the corresponding employee exists in the organization, the process proceeds to step 908 (step 905).

As a result of the determination (step 905), if the employee having the sender email address does not exist in the organization, it can be seen that the person of the sender email address is a person outside the company. Further, the employee ID of the employee having the transmission destination email address is specified from the attribute information DB 301, and the transmission source email address is stored in the relationship information DB 401 among the related party information of the row corresponding to the specified employee ID. (Step 906).

As a result of the search in step 906, it can be seen that if the source email address exists, the employee having the destination email address and the outside person having the source email address are in a relationship with each other. At this time, it is determined that the unique information (for example, mail address) of the person having the transmission source mail address is already stored in the related person information 403, and it is not necessary to add, and the process is terminated. If the sender email address does not exist, the process proceeds to step 908 (step 907).

In this processing step, it is determined that the employee having the transmission destination email address and the outside person having the transmission source email address are related parties at the timing of the processing step, and the transmission source email address is included in the related party information 403. Is added (step 908).

Next, the processing after step 908 will be described.

As a result of the search in step 905, if it is determined that the person having the sender email address is an employee of the organization, the employee ID of the employee is identified from the attribute information DB 301, and the destination employee is stored in the relationship information DB 403. It is searched whether or not the identified employee ID of the sender employee is stored in the relation information of the row corresponding to the employee ID of the employee (step 909).

As a result of the search in the above step 909, when the employee ID of the transmission source employee exists, it can be understood that the transmission destination employee and the transmission source employee are in a relationship between related parties. At this time, it is determined that the unique information (for example, employee ID) of the transmission source employee is already stored in the related person information 403, and it is determined that there is no need for additional writing, and the process ends. If the employee ID of the source employee does not exist, the process proceeds to step 910 (step 910).

In this processing step, it is determined that the transmission destination employee and the transmission source employee are related parties at the timing of this processing step, and the employee ID of the transmission source employee is added to the related party information 403 (step 911). The above is the details of the related information DB creation / update process.

Next, details of the countermeasure range prioritization process in step 812 will be described according to the process flow shown in FIG. First, Example 1 will be described.

The countermeasure range prioritization function 108 acquires the operation characteristic information of the malware whose infection is detected from the operation characteristic DB 105 (step 1001). Next, based on the acquired operating characteristic information, a relevant relation information table is selected (step 1002). For example, when the malware whose infection is detected is the malware ID “001”, since it is a type infected by the malware “SNS” and “mail”, the mail exchange relation information table shown in FIG. The SNS exchange relation information table shown in FIG. 4B is selected.

Next, the distance between the relevant component stored in the relevant relation information table and the infected component is calculated (step 1003). For example, in the mail exchange relation information table shown in FIG. 4A, when the constituent element is the employee ID “001” and the infected constituent element is the employee ID “003”, the distance between them is “1”. .

Next, information on the constituent element is searched from the attribute information DB 104, and corresponding attribute information (for example, job title) is acquired (step 1004).

Next, based on the distance from the infection component and the acquired attribute information (for example, job title), the corresponding policy information is acquired from the countermeasure range prioritizing policy information DB 103 (step 1005), and the acquired policy information is acquired. Based on the above, a priority is assigned to the component (step 1006). For example, if the relevant component is separated from the infected component by a distance “1” and the title of the relevant component is “office manager”, as shown in FIG. Is acquired and assigned to the component.

As a result of the process of step 1006, if the prioritization process for all the components is completed, the process proceeds to step 1008, and if not completed, the process proceeds to step 1007 (step 1007).

As a result of the processing in step 1007, when the prioritization processing for all the constituent elements is not completed, the constituent element that has not been prioritized is selected, and the processing proceeds to step 10003 for the constituent element (step 1008). ).

As a result of the processing in step 1007, when the prioritization processing for all the components is completed, it is searched whether there is a case similar to the operation characteristics of the malware in the countermeasure history DB 106, and a similar case is found The process proceeds to step 1009, and if a similar case is not found, the process proceeds to step 1012 (step 1009). At this time, as to what kind of case is judged to be similar, there are similarities of malware file names and those with the same output file.

When, as a result of the processing in step 1009, a case similar to the operation characteristic of the malware is found, countermeasure history information is acquired from the corresponding past countermeasure history information ⇒ future countermeasure policy information 705 (step 1010). For example, if the malware with a similar file name is “ABC.exe”, and if the infection is confirmed with a component whose mail exchange relationship is “10”, the component corresponding to the above condition will be The countermeasure history information for assigning the priority “3” is acquired.

Next, it is determined which concept is the distance from the acquired countermeasure history information, and the relevant relation information table is selected (step 1011). For example, in the above example, it is determined that the distance is based on the concept of “mail” exchange.

Next, the corresponding component is selected from the acquired countermeasure history information, the corresponding priority is assigned to the selected component, and the process proceeds to step 1013 (step 1012). For example, when the countermeasure history information is acquired, a priority “3” is assigned to a component having an email exchange relationship distance of “10”.

In other words, in steps 1008 to 1011, it is determined whether or not there is malware similar to the malware for which the priority of the countermeasure range has been determined, and when it is determined that there is similar malware, , The priority of the countermeasure range set for malware is assigned.

Finally, the list information of the components to which the priority is assigned in the above step is output (step 1013).

The above is the details of the prioritization processing of the countermeasure scope when a cyber attack is detected by a certain component of the organization. Thereby, it is possible to reduce the trouble of determining from which component of the organization the component should be preferentially treated based on the infected component.

In this way, according to this system, it is possible to prioritize the components of the system that require countermeasures, so by implementing countermeasures from a high priority range, the type that spreads infection via the network It is possible to implement effective malware countermeasures (infection investigations and countermeasures against the infected components) against other malware.

Next, Example 2 will be described. In the present embodiment, the countermeasure range prioritization policy DB 1101 of FIG. 11 is used, which is an extension of the configuration of the countermeasure range prioritization policy DB 501 used in the first embodiment.

Specifically, the countermeasure range prioritization policy DB 1101 includes a countermeasure range classification element 1102, a distance 1103 from an infection component (in a mail exchange relationship), a position 1104, a countermeasure range prioritization policy 1105, and the configuration It includes an element priority 1106, a prioritized extended policy 1107, a priority 1108, a target range 1109, and the like.

Since the view of the countermeasure range prioritization policy DB 1101 in this configuration is basically the same as the countermeasure range prioritization policy DB 501, the priority added to the configuration of the countermeasure range prioritization policy DB 501 will be described below. The rating extension policy 1107, the priority 1108, and the target range 1109 will be described. Specifically, the countermeasure range prioritization policy DB 501 holds policy information on the priority assigned to the constituent elements corresponding to the classification elements of the countermeasure range classification element 502, whereas the countermeasure range priority The rating policy DB 1101 further holds information on a target range to which priority is assigned and information on the priority from the constituent elements.

For example, if the distance 1103 from the infected component (in the mail exchange relationship) is “2” and the position 1104 of the component is “business manager”, the priority assigned to the component is From the priority 1106 of the constituent element, it can be seen that it is “4”, and from the information of the priority 1108 and the target range 1109 of the prioritized extended policy 1107, “the constituent element up to the distance 3 from the constituent element” It can be seen that priority “3” is assigned to all. In FIG. 11, if the above-mentioned position is “business manager”, the position is higher than the position “department manager” and should be the countermeasure range (components that can be affected by infection. The range of the component's skirt composed of the surrounding components.) The priority of the position “business manager” is given priority over the priority of the position “department manager”. The degree is larger.

At this time, the concept of the distance in the target range 1109 is the distance 1103 from the infection component (in the mail exchange relationship) in the element of the countermeasure range classification element 1102 in this example, but it is not necessarily matched with this. There is no need. Further, in the case where the priority that can be assigned to each component is overlapped by applying the prioritized extended policy 1107, higher priority is applied in this embodiment. The final priority application policy is not limited to this.

Hereinafter, the processing of the second embodiment will be described. In the second embodiment, first, the processing from step 1001 to step 1007 in the first embodiment is the same, and the result of completion of the prioritization processing for all the components in step 1006 is acquired (step 1202).

Next, out of all the acquired components, an arbitrary component that has not been prioritized according to the prioritized extended policy 1107 is selected from the countermeasure range prioritization policy DB 1101 (step 1202). ).

Next, prioritized extended policy information corresponding to the selected component is acquired (1203).

Next, constituent elements corresponding to the target range of the acquired prioritized extended policy are extracted (step 1204).

Next, the priority of the acquired prioritized extended policy is assigned to the extracted component (step 1205).

Next, it is determined whether or not the prioritization processing for all the components has been completed. If completed, the process proceeds to step 1207, and if not completed, the process proceeds to step 1202 (step 1206).

As a result of the processing in step 1206, when the prioritization processing for all components is completed, the subsequent processing is performed from the processing in step 1008 to the processing in step 1011 as in the processing in the first embodiment (step 1207). .

Finally, the list information of the component assigned the priority in the above step is output (step 1208).

The above is the details of the countermeasure range prioritization processing in the second embodiment. As a result, even when a component other than the infection component is temporarily infected, and when a component other than the infection component and its surrounding components should be preferentially taken, the priority of the measure is increased. It is possible to reduce the trouble of determining that it should be.

101: Cyber attack countermeasure range prioritization system 102: Relation information DB
103: Policy range prioritization policy DB
104: Attribute information DB
105: Operation characteristic information DB
106: Countermeasure history information DB
107: Relationship information creation / update function 108: Measure range prioritization function

Claims

A cyber attack countermeasure range prioritization system that prioritizes the scope of countermeasures against components infected with malware, consisting of multiple components,
The characteristic information indicating the characteristic of the malware infected with the component is acquired, and is indicated in the characteristic information based on the relationship information indicating the relationship between the components stored in the storage unit and the characteristic information. Based on the policy information that calculates the distance between the component and the infected component in the infection type of the malware, and associates the calculated distance with the prioritization policy indicating the countermeasure range, the countermeasure Measure scope prioritization section that determines the priority of the scope,
A cyber attack countermeasure range prioritizing system characterized by comprising:
The cyber attack countermeasure range prioritizing system according to claim 1,
The countermeasure range prioritization unit determines the priority of the countermeasure range based on attribute information indicating an organizational attribute of the component stored in the storage unit, the calculated distance, and the policy information. ,
Cyber attack countermeasure range prioritization system characterized by that.
The cyber attack countermeasure range prioritizing system according to claim 1,
A relationship information generating unit that generates the relationship information based on history information performed between the components;
A cyber attack countermeasure range prioritizing system characterized by comprising:
The cyber attack countermeasure range prioritizing system according to claim 2,
The countermeasure range prioritization unit is based on the infection type and the attribute information, the calculated distance, and the policy information of the malware determined by whether or not infection spreads in the exchange between the components. Determining the priority of the scope of the measures;
Cyber attack countermeasure range prioritization system characterized by that.
The cyber attack countermeasure range prioritizing system according to claim 1,
The storage unit stores a past countermeasure history for the infected component,
The countermeasure range prioritization unit determines whether there is malware similar to the malware that has determined the priority of the countermeasure range from the past countermeasure history, and determines that there is the similar malware A priority of the countermeasure range determined for the malware is assigned to a component infected by the similar malware,
Cyber attack countermeasure range prioritization system characterized by that.
The cyber attack countermeasure range prioritizing system according to claim 2,
The countermeasure range prioritization unit includes an extended prioritization policy indicating the countermeasure range determined according to the attribute information and the distance with respect to the constituent elements around the component that has determined the priority of the countermeasure range Based on the above, the priority of the countermeasure range is determined.
Cyber attack countermeasure range prioritization system characterized by that.
A cyber attack countermeasure range prioritization method that prioritizes the countermeasure range for a component that is composed of multiple components and infected with malware,
An acquisition step of acquiring characteristic information indicating characteristics of the malware infected with the component;
Based on the relationship information indicating the relationship between the components stored in the storage unit and the characteristic information, the distance between the component and the infected component in the malware infection type indicated in the characteristic information A calculating step for calculating;
A countermeasure range prioritizing step for determining the priority of the countermeasure range based on the policy information in which the calculated distance and the prioritization policy indicating the countermeasure range are associated;
A cyber attack countermeasure range prioritizing method characterized by including:
The cyber attack countermeasure range prioritizing method according to claim 7,
In the countermeasure range prioritizing step, the priority of the countermeasure range is determined based on attribute information indicating an organizational attribute of the component stored in the storage unit, the calculated distance, and the policy information. ,
A cyber attack countermeasure range prioritizing method characterized by this.
The cyber attack countermeasure range prioritizing method according to claim 7,
A relationship information generation step for generating the relationship information based on history information performed between the components;
A cyber attack countermeasure range prioritizing method characterized by further including:
The cyber attack countermeasure range prioritizing method according to claim 8,
In the countermeasure range prioritizing step, based on the infection type of the malware and whether the attribute information, the calculated distance, and the policy information determined by whether or not the infection spreads in the exchange between the components, Determining the priority of the scope of the measures;
A cyber attack countermeasure range prioritizing method characterized by this.
The cyber attack countermeasure range prioritizing method according to claim 7,
In the countermeasure range prioritizing step, it is determined whether or not there is malware similar to the malware that has determined the priority of the countermeasure range from the past countermeasure history for the infected component stored in the storage unit. If it is determined that there is the similar malware, the priority of the countermeasure range determined for the malware is assigned to the component infected by the similar malware.
A cyber attack countermeasure range prioritizing method characterized by this.
The cyber attack countermeasure range prioritizing method according to claim 8,
In the countermeasure range prioritizing step, an extended prioritization policy indicating the countermeasure range determined according to the attribute information and the distance for the constituent elements around the component that has determined the priority of the countermeasure range Based on the above, the priority of the countermeasure range is determined.
A cyber attack countermeasure range prioritizing method characterized by this.