WO2020100570A1 - Estimation method, estimation device, and estimation program - Google Patents

Abstract

This estimation device (10) receives, as inputs from a terminal, apparatus information for identifying an apparatus in a network and an observation event generated in the apparatus. The estimation device (10) acquires attribute information about a first apparatus, which corresponds to the received apparatus information, and estimates the risk of the attack to be received by the apparatus in the network on the basis of the received observation event. The estimation device (10) estimates, on the basis of the estimation result, a degree of influence which is exerted on a business pertaining to a service provided by the network and is caused by the attack received by the apparatus in the network, and outputs the estimation result.

Description

Estimating method, estimating device, and estimating program

The present invention relates to an estimation method, an estimation device, and an estimation program.

Nowadays, various information and services have been digitized, and management is aware of the value and role in the corporate strategy for important information such as the system used as the basis of information and trade secrets, and is involved in dealing with risks due to cyber attacks. It is necessary to clarify the policy. The management identifies the information that should be protected among the assets owned by the company, grasps the cyber security risk that may occur, and examines the cyber security countermeasure policy from the viewpoint of risk reduction measures, avoidance measures, and transfer measures, Implement. In addition, the Ministry of Economy, Trade and Industry has issued a guideline that a risk that is omitted from the examination by the management should be identified as a residual risk (see Non-Patent Document 1).

Here, the manager installs antivirus software for protecting terminals and servers from computer viruses, or installs antivirus software between the company network and the Internet, as one of the methods for dealing with risks. Then, it is possible to take measures such as preventing an external attack. By taking such measures, it is possible to reduce cyber security risk.

In addition, when a cyber attack occurs, you will suffer damage such as service down and information leakage, and damages to third parties, corresponding expenses, profit damage, etc., so reduce costs with cyber risk insurance There is also a service.

Then, on the basis of the device information and the security information that constitute the IT system, the vulnerability of the device acquired in advance, the business impact of the device, and the relationship with other devices connected to the device are considered. There is also a method to judge the risk. By using this method, the priority order of the risk is determined, and therefore, when the attack is found, the management executes the countermeasure against the attack according to the priority order.

Furthermore, in recent years, a method of making a more accurate assessment by combining both natural disaster forecast and cyber forecast has been proposed (see Patent Document 1).

JP, 2017-117067, A

Here, as measures against crises such as cyber incidents, some companies are implementing security measures according to their own policies, but attacks are evolving day by day and it is impossible to completely prevent them. difficult. In addition, as in small and medium-sized enterprises, there are not a few places where the budget for security measures and specialized personnel cannot be allocated, and it is a fact that information leaks and incidents occur on a daily basis.

If a certain terminal in a company is attacked by a cyber attack, the attack may be further expanded depending on the characteristics of the attack and the virus. For example, when a terminal is attacked by an unknown virus, the virus definition file at that time does not include unknown virus information, and therefore cannot be detected by antivirus software. Also, it is not perfect because there are attacks such as intrusion of computer viruses using emails and internal crimes that cannot be prevented by firewalls.

In addition, companies have been blamed for the failure by external media such as the media because of delays in publicizing the damage caused by cyber attacks, and due to a series of measures such as Twitter becoming uncontrollable due to the net flame The impact on the business is increasing, such as a decline in sales, or a supervisory agency instructing us to delay the response, and the brand declines and the products we handle are restricted.

Also, the aforementioned cyber risk insurance is limited to compensation for damages and compensation for costs. For this reason, even if you have cyber risk insurance, it does not reduce the scope of damage from cyber attacks, nor does it have the function of stopping the decline in the brand of a company. Also, the method described in Patent Document 1 does not reduce the damage range of a cyber attack like the cyber risk insurance, and does not have a function of stopping the deterioration of the brand of the company.

The present invention has been made in view of the above, and at the time when an observation event likely to lead to a cyber incident occurs, an estimation method, an estimation device, and an estimation method capable of grasping the impact of an attack on the business at an early stage. The purpose is to provide the program.

In order to solve the above-mentioned problems and to achieve the object, an estimation method of the present invention is an estimation method executed by an estimation device, which is device information for identifying a device in a network and an observation event generated in the device. And an attribute information of the first device corresponding to the device information accepted in the accepting process, and based on the acquired attribute information and the observation event accepted in the accepting process. Then, based on the first estimation step of estimating the risk that the device in the network is attacked, and the estimation result in the first estimation step, the business related to the service provided by the network due to the attack of the device in the network It is characterized by including a second estimation step of estimating the degree of influence and a first output step of outputting the estimation result estimated in the second estimation step.

According to the present invention, when an observation event that may lead to a cyber incident occurs, it is possible to grasp the impact of the attack on the business at an early stage.

FIG. 1 is a block diagram showing a configuration example of a system including an estimation device according to an embodiment. FIG. 2 is a diagram showing a configuration example of a network managed by the system according to the embodiment. FIG. 3 is a diagram showing an example of the data structure of the device information table. FIG. 4 is a diagram showing an example of the data structure of the segment connection information table. FIG. 5 is a diagram showing an example of the data structure of the observation event information table. FIG. 6 is a diagram showing an example of the data structure of the incident information table. FIG. 7 is a diagram showing an example of the data structure of a relationship presentation table of the purpose of use and damage. FIG. 8 is a diagram showing an example of the data structure of the attack type information table. FIG. 9 is a diagram showing an example of the data structure of the countermeasure table. FIG. 10 is a diagram showing an example of the data structure of an attack type information table for countermeasures. FIG. 11 is a diagram showing an example of the data structure of the countermeasure status report table for incidents. FIG. 12 is a diagram showing an example of the data structure of the business influence table regarding the service name. FIG. 13 is a diagram showing an example of a screen displayed on the user terminal. FIG. 14 is a diagram showing an example of damage probability calculation by the risk estimation unit for the network shown in FIG. FIG. 15 is a diagram illustrating a method of calculating the attack transition probability. FIG. 16 is a diagram illustrating a method of calculating the probability of occurrence of each damage depending on the type of attack. FIG. 17 is a diagram showing an example of a screen displayed on the user terminal. FIG. 18 is a diagram illustrating a correction process performed by the risk estimation unit. FIG. 19 is a diagram showing an example of a screen displayed on the user terminal. FIG. 20 is a diagram showing an example of a screen displayed on the user terminal. FIG. 21 is a sequence diagram showing an example of the flow of the estimation process according to the embodiment. FIG. 22 is a diagram illustrating a computer that executes the estimation program.

Hereinafter, embodiments of an estimation method, an estimation device, and an estimation program according to the present application will be described in detail with reference to the drawings. The estimation method, the estimation device, and the estimation program according to the present application are not limited by this embodiment. In the description of the drawings, the same parts are designated by the same reference numerals.

[Embodiment]
In the following embodiments, the configuration of the estimation apparatus according to the first embodiment and the processing flow of the estimation apparatus will be sequentially described, and finally, the effect of the embodiment will be described.

[Configuration of estimation device]
First, a configuration example of a system including the estimation device according to the embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration example of a system including an estimation device 10 according to an embodiment. The system includes, for example, an estimation device 10 and a user terminal 20 as shown in FIG. The estimation device 10 and the user terminal 20 are connected via a connection line 30 such as the Internet. The configuration shown in FIG. 1 is merely an example, and the specific configuration and the number of devices are not particularly limited. Also, a plurality of user terminals 20 may be provided. Although the system illustrated in FIG. 1 has a client-server system configuration, it may have a stand-alone configuration.

The estimation device 10 is a server device that estimates the risk of an attack on a device in the observation target network, estimates the business impact on the service provided by the network based on the estimation result, and outputs the estimated impact to the user terminal 20. is there. Specifically, the estimation device 10 receives, from the user terminal 20, a device ID for identifying a device in the network and an observation event that has occurred in the device. In addition, the estimation device 10 registers in advance incident information in which a set of an equipment ID and an observation event and an incident ID are associated with each other, and receives an input of the incident ID from the user terminal 20 to obtain the equipment ID and the observation event. May be designated.

Then, the estimation device 10 estimates the risk of the device in the network being attacked based on the attribute information of the device corresponding to the device ID and the observed event. Then, the estimation device 10 estimates the degree of influence of the service provided by the network on the business due to the attack on the device in the network based on the estimation result regarding the risk. The estimation device 10 outputs the estimated degree of influence on the business to the user terminal 20. That is, the estimation device 10 estimates an attack on a device in the network based on the input information indicating what kind of observation event occurred on the certain device, and further affects the business caused by the attack. The degree is estimated and output to the user terminal 20.

The user terminal 20 is a device such as a PC (Personal Computer) or a smartphone, and is, for example, a device used by a user of an information system unit of a company that provides a network service. The user terminal 20 notifies the estimation device 10 of input information indicating what kind of observation event has occurred with respect to a certain device, receives the degree of influence on the business regarding the service provided by the network, and displays the received content. indicate. For example, the user terminal 20 displays, as the degree of business impact, an estimated amount of money such as a decrease in sales due to a service stop due to an attack or compensation of information caused by damage such as information leakage due to an attack.

Next, the configuration of the estimation device 10 will be described. As shown in FIG. 1, the estimation device 10 includes a communication processing unit 11, a storage unit 12, and a control unit 13.

The communication processing unit 11 controls communication regarding various types of information. For example, the communication processing unit 11 receives, from the user terminal 20, a device ID for identifying a device on the network and an observation event generated in the device as input information. In addition, the communication processing unit 11 transmits, to the user terminal 20, an estimation result regarding the degree of influence on the business due to the attack on the device in the network.

The storage unit 12 stores data and programs necessary for various processes performed by the control unit 13. For example, the storage unit 12 is a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory (Flash Memory), or a storage device such as a hard disk or an optical disk. The storage unit 12 includes a device information storage unit 121, an observation information storage unit 122, an incident information storage unit 123, an attribute information storage unit 124, a media trend evaluation information storage unit 125, a social media analysis information storage unit 126, and a company basic information storage unit. It has 127.

Here, for the sake of explanation, a configuration example of a network which is an estimation target of the estimation device 10 is shown. FIG. 2 is a diagram showing a configuration example of a network managed by the system according to the embodiment. As shown in Fig. 2, the network to be managed, which consists of DMZ (DeMilitarized Zone), internal LAN (Local Area Network), and business LAN, is connected to the Internet with a firewall in front. Various information is registered in the various tables stored in the storage unit 12 according to the network configuration shown in FIG.

First, the device information storage unit 121 will be described. The device information storage unit 121 stores information about each device that constitutes the network. The device information storage unit 121 stores, for example, a device information table. FIG. 3 is a diagram showing an example of the data structure of the device information table. As shown in FIG. 3, the device information table 121a includes a device ID, a device type, an attribute value of the device, a purpose of use, presence / absence of confidential information, a network belonging segment in which the device is placed, and OS information of the device. , Middleware, applications used, service information related to the device, etc. are described.

The device information storage unit 121 also stores a segment connection information table. FIG. 4 is a diagram showing an example of the data structure of the segment connection information table. As shown in FIG. 2, the network managed by the system is divided into a plurality of network segments. Therefore, the segment connection information table 121b illustrated in FIG. 4 describes the number of hops from a certain segment to another segment in the network based on the network configuration diagram. The number of hops is the number of transfer devices and relay equipment through which a communication partner is reached on the communication network.

The observation information storage unit 122 stores the observation event information that defines the observation events that may occur when the attribute information is attacked. Specifically, the observation information storage unit 122 stores an observation event information table in which an observation event generated in the device is associated with the type of attack that the device is likely to receive and the probability of receiving the attack. Further, since a plurality of observation events can occur with respect to a certain attack, the observation event information table defines a probability calculation method for determining one probability for an attack.

FIG. 5 is a diagram showing an example of the data structure of the observation event information table. As shown in FIG. 5, the observation event information table 122a has items of an ID, an attribute value of the device, an observation event that occurred in the device, an attack type that the crisis receives, a probability that the device receives this attack, and a probability calculation method. Specifically, in the observation event information table 122a, when an observation event occurs in which the attribute value “Web server” has “the server service suddenly stops” in the ID “1”, an attack that causes “unauthorized intrusion” It is described that the probability of "80%" is received, and the calculation method of the probability is "f (x1, x2, x3)".

The incident information storage unit 123 stores an incident information table. The incident information table is a table for recording information at the time of occurrence of some unusual event.

FIG. 6 is a diagram showing an example of the data structure of the incident information table. As shown in FIG. 6, in the incident information table 123a, the incident ID includes the date and time of the observation event, the observation event ID for identifying the observation event, the attack type, the determined attack probability, and the device ID of the attack target device. Registration / update date and time are described in association with each other. Since more detailed information can be grasped as the analysis of the information related to the incident progresses, the analysis result such as the attack type and the attack probability and the update date and time are recorded in the incident information table 123a according to the analysis. It is assumed that the device ID, the set of observation events, and the like are specified by the user terminal 20, and the incident information management unit 133 (described later) gives the incident ID and registers it.

The attribute information storage unit 124 stores attribute information defining various attributes of each device in the network. For example, the attribute information storage unit 124 stores a relationship presentation table between the purpose of use and damage. FIG. 7 is a diagram showing an example of the data structure of a relationship presentation table of the purpose of use and damage.

As shown in FIG. 7, in the relationship presentation table 124a between the purpose of use and damage, the purpose of use is associated with specific contents of damage such as service stop, service tampering, and information leakage. Each of these damages is assumed damage for the purpose of use in the device information table 121a (see FIG. 3) and has been identified in advance. In FIG. 7, “1” is described for each damage if there is a relationship, and “0” is described if there is no relationship.

Further, the attribute information storage unit 124 stores an attack type information table. FIG. 8 is a diagram showing an example of the data structure of the attack type information table. As shown in FIG. 8, in the attack type information table 124b, the attack type ID, the attack target, and the probability of occurrence of each damage assumed in advance are described in association with each other. The probability that each damage occurs in the attack type information table 124b may be set in advance, or the probability may be constantly changed by reflecting the incident response result.

Also, the attribute information storage unit 124 stores a countermeasure table. FIG. 9 is a diagram showing an example of the data structure of the countermeasure table. As shown in FIG. 9, the countermeasure table 124c associates the attack ID with the countermeasure name against the cyber attack and the specific procedure.

Further, the attribute information storage unit 124 stores an attack type information table for countermeasures. FIG. 10 is a diagram showing an example of the data structure of an attack type information table for countermeasures. As shown in FIG. 10, in the attack type information table 124d for the countermeasure, the countermeasure ID and the occurrence probability of each damage are associated with the countermeasure ID.

Since the attack probability (see the incident information table 123a in FIG. 6) may be lowered by implementing the countermeasures in the countermeasure table 124c (see FIG. 9), the attack type information table 124 d for the countermeasure plan has a countermeasure for each countermeasure. By taking countermeasures, the probability of each damage caused by the attack is set. For example, the case where “Countermeasure 1” with the countermeasure ID “1” shown in FIG. 10 is executed will be described. In this case, of the damage caused by "attack 1", the probability of "damage 1" is "x11", the probability of "damage 2" is "x12", and the probability of "damage 3" is "x13". Is. Among the damages caused by "Attack 2", the probability of "damage 1" is "x21", the probability of "damage 2" is "x22", and the probability of "damage 3" is "x23". is there.

The attribute information storage unit 124 also stores a countermeasure status report table for incidents. FIG. 11 is a diagram showing an example of the data structure of the countermeasure status report table for incidents. As shown in FIG. 11, the countermeasure status report table 124e for an incident describes an incident ID, a registration date / time, an update date / time, a countermeasure ID of a countermeasure performed for this incident, and an ID indicating an attack type for the countermeasure. It

Next, the media trend evaluation information storage unit 125 will be described. The media trend evaluation information storage unit 125 stores the media trend and the result of processing the media trend in the external situation. The media trend evaluation information storage unit 125 records, for example, news articles and news contents in association with publication dates and times. The media trend evaluation information storage unit 125 also stores the ratio of positive news reports, neutral news reports, and negative news reports to the total after the case became public.

The social media analysis information storage unit 126 stores information about the reputation of SNS (Social Networking Service) such as Twitter among the external situations, and the result of processing the SNS information. For example, some tools for monitoring interactions on social media have a function of numerically notifying increase or decrease for each risk importance level. The social media analysis information storage unit 126 may store the notified numerical value as an index of the degree of influence.

The company basic information storage unit 127 stores information that affects the business regarding each service. The company basic information storage unit 127 stores, for example, a business influence table regarding a service name. FIG. 12 is a diagram showing an example of the data structure of the business influence table regarding the service name. As shown in FIG. 12, in the business influence table 127a relating to service names, the target device name and the item affecting the business are associated for each service. Items that affect business include, for example, personal information, personal information compensation amount, confidential information, confidential information compensation amount, court cost, daily service sales, and impact on stock prices. In the business impact table 127a related to service names, the number of items, the amount of compensation, and the rate of decline estimated in advance are described for each item.

The control unit 13 has an internal memory for storing a program defining various processing procedures and the like and required data, and executes various processing by these. Here, the control unit 13 is an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The control unit 13 includes a process reception unit 131, a system information management unit 132, an incident information management unit 133, a risk estimation unit 134, an external situation management unit 135, a business impact degree calculation unit 136, and an output unit 137.

The process receiving unit 131 receives input information from the user terminal 20 via the communication processing unit 11. For example, the process reception unit 131 receives, from the user terminal 20, device information (device ID) for identifying a device on the network and an observation event that occurred in the device. Further, when the damage probability information and the countermeasure information are displayed on the user terminal 20, the processing reception unit 131 inputs the countermeasure information indicating the selected countermeasure among the displayed countermeasures from the user terminal 20. Accept.

When the system information management unit 132 receives the device name and the event observation date and time from the process reception unit 131, the system information management unit 132 corresponds to the input device name (device ID) from the device information table 121a stored in the device information storage unit 121. Extract the attribute value. Then, the system information management unit 132 extracts the observation event corresponding to the extracted attribute value from the observation event information table 122a stored in the observation information storage unit 122. The system information management unit 132 displays the extracted observation event on the screen of the user terminal 20 via the output unit 137 (described later) and the communication processing unit 11.

When the incident information management unit 133 receives the event observation from the process reception unit 131, the incident information management unit 133 refers to the observation information storage unit 122 based on the attribute of the device extracted by the system information management unit 132 and the received observation event. , The type of expected attack on the device and its occurrence probability are calculated. The incident information management unit 133 registers the attack type and the occurrence probability of the attack in the incident information storage unit 123 in association with information such as date and time of occurrence, observation event ID, and device ID. In addition, when the incident information management unit 133 receives the countermeasure information selected by the user terminal from the process reception unit 131, the incident information management unit 133 registers the countermeasure information report table 124e for the incident in the attribute information storage unit 124.

The risk estimation unit 134 acquires the attribute information of the device (first device) corresponding to the device ID received by the process reception unit 131 from the attribute information storage unit 124, and the acquired attribute information and the process reception unit receive it. Based on the observed events, the risk of the device in the network being attacked is estimated.

Further, the risk estimation unit 134 obtains the attack transition probability from the first device to the device (the second device) where the attack may transit, based on the segment connection information stored in the device information storage unit 121. .. Then, the risk estimation unit 134 determines whether or not an attack has occurred based on the content of the damage and the probability of occurrence of the damage depending on the type of the attack according to the intended use of each device, and the attack transition probability to the second device. Estimate the probability of damage. Note that the risk estimation unit 134 may use the probability of attack transition to the second device as the weight of the hop count. In this case, the risk estimation unit 134 calculates the attack transition probability to the second device by multiplying the attack probability of the transition source device with a value based on the number of hops as a weight. The risk estimation unit 134 outputs, via the output unit 137 and the communication processing unit 11, the probability of damage caused by an attack and the countermeasures against the attack acquired from the attribute information storage unit 124 to the user terminal 20.

Then, when the risk estimation unit 134 receives the selected countermeasure from the user terminal 20 via the processing reception unit 131, the risk estimation unit 134 uses the correction value corresponding to the countermeasure acquired from the attribute information storage unit 124, Correct the probability of damage caused by an attack. Then, the risk estimating unit 134 outputs the corrected occurrence probability of damage due to the attack to the user terminal 20 via the output unit 137 and the communication processing unit 11.

The external situation management unit 135 acquires various external situations and registers them in the media trend evaluation information storage unit 125 and the social media analysis information storage unit 126. The external situation management unit 135 also obtains a business impact index and outputs it to the business impact degree calculation unit 136. For example, as a business impact index, a numerical value showing the increase or decrease according to the importance of risk, which was notified using a tool that monitors interactions on social media, or extracted from the headlines and contents of company articles for news articles There is a degree of loss of corporate image based on favorable articles, intermediate articles, and malicious articles.

Based on the estimation result by the risk estimation unit 134, the business impact calculation unit 136 estimates the impact on the business of the service provided by the network due to the attack of the device in the network. The business impact degree calculation unit 136 obtains a monetary amount related to the impact on the business due to the damage caused by the attack regarding the service provided by the network, based on various information that each service influences. Then, the business impact degree calculation unit 136 estimates the impact degree on the business by using the obtained amount of money and the probability of occurrence of damage due to the attack. Specifically, the business impact degree calculation unit 136 sets the amount of money obtained by multiplying the obtained amount of money by the probability of occurrence of damage as the degree of impact on the business. Note that the business impact degree calculation unit 136 also multiplies the obtained amount by the probability of damage caused by an attack and a business impact index based on the external situation as weighting to obtain the degree of impact on the business. Good.

The output unit 137 outputs the estimation result estimated by the business impact degree calculation unit 136 to the user terminal 20 via the communication processing unit 11. The output unit 137 outputs the estimation result by the risk estimation unit 134 to the user terminal 20 via the communication processing unit 11.

[Flow of estimation processing]
Next, the flow of the estimation process performed by the estimation device 10 will be described. FIG. 13 is a diagram showing an example of a screen displayed on the user terminal 20.

First, when a user discovers some unusual event, the user displays the screen M1 shown in FIG. 13, selects the device name (device ID) "server-S" in which the event was discovered, and selects the event. If you enter the confirmed date and time "2018/8/21 10:34", the input content is sent to the process reception unit 131. The process reception unit 131 outputs these pieces of information to the system information management unit 132. The system information management unit 132 extracts the attribute value “Web server” corresponding to the input device ID “server-S” from the device information table 121a (see FIG. 3) in the device information storage unit 121.

Next, the system information management unit 132, based on the extracted attribute value “Web server”, from the observation event information table 122a (see FIG. 5), “server service corresponding to observation event IDs“ 1 ”to“ 4 ”. Is suddenly stopped ”,“ NW is down or speed down ”,“ server behavior is strange ”, and“ DB server load increase ”are extracted, and“ confirmed ”is displayed on the screen M1 (see FIG. 13) of the user terminal 20. "Events" that are sequentially displayed (see region R1 in FIG. 13). In this case, for example, the user checks the check boxes of the confirmation events “server service suddenly stops” and “NW is down or speed down” on the screen M1 and selects the registration button. As a result, from the user terminal 20, the confirmation event “server service suddenly stopped” (observation event ID “1”), “NW down or speed down” (observation event ID “server-S”) has occurred. 2 ”) is transmitted to the estimation device 10.

In the estimation device 10, upon receipt of this confirmation event, the incident information management unit 133 refers to the observation event information table 122a, acquires the probability of an attack on the confirmation event and the probability calculation method, and calculates the attack occurrence rate.

First, the incident information management unit 133 acquires a function defined for each attack type corresponding to an observation event from the observation event information table 122a. This function is defined as a collection of multiple probabilities for each attack type. For example, in an unauthorized intrusion attack, events that can be observed include "observation event ID" 1 "," server service suddenly stops ", and observation event ID" 2 "," NW is down or speed down ", Since there are three observation event IDs “3”, “the behavior of the server is strange”, the function “f (x1, x2, x3)” has three parameters corresponding to each ID, “x1” to “x3”. Is defined.

The incident information management unit 133, when a plurality of observation events are selected by the user, performs a calculation to bring the probability of an attack to one by the function thereof. For example, assume that "f (x1, x2, x3) = max (x1, x2, x3)" is defined. In this example, since the observation event IDs “1” and “2” are checked, “x1 = 80%” and “x2 = 20%” are set in the probability column of the observation event information table 122a. Then, since the observation event ID “3” is not checked, “x3 = 0%” is set. In this case, since the maximum value is “x1”, the incident information management unit 133 determines the possibility of an unauthorized intrusion attack to be “80%”. The incident information management unit 133 registers “80%” in the probability column of the “server-S” (incident ID “1”) in which the abnormality was observed this time, in the incident information table 123a of the incident information storage unit 123.

Next, the incident information management unit outputs the information registered in the incident information table 123a to the risk estimation unit 134. That is, it is the information that the “unauthorized attack” of the “server-S” (incident ID “1”) that has observed the abnormality this time occurs with a probability of “80%”. The risk estimation unit 134 divides this result into the first stage and the second stage and the third stage, and calculates the probability of occurrence of damage due to an attack on a device of the network. FIG. 14 is a diagram showing an example of damage probability calculation by the risk estimation unit 134 for the network shown in FIG.

Subsequently, the risk estimation unit 134 executes the second stage calculation process. In the second stage, the risk estimation unit 134 obtains the attack transition probability from the "server-S" (first device) where the event was observed to the second device to which the attack may transit.

First, in the calculation process of the second stage, the risk estimation unit 134 uses the device information table 121a and the segment information connection table 122b of the device information storage unit 121 based on the device ID “server-S” to attack the “server”. -S ”gets the segment information to which it belongs. In this case, the risk estimation unit 134 acquires the belonging segment “DMZ” of the “server-S” from the device information table 121a, and the hop count “1” (“DMZ” corresponding to the “DMZ” from the segment information connection table 122b. )), “3” (“Internal LAN”), “3” (“Business LAN”). The risk estimation unit 134 extracts, from the “server-S”, a device in which an attack may have spread based on the acquired information. For example, in the network of FIG. 2, "server-T" in the DMZ, "server-U" and "server-Q" in the internal LAN, and "PC-A" in the business LAN are attacked Is likely to be expanding.

If the risk estimation unit 134 assumes that the attack type for the “server-S” is “illegal intrusion” indicating the highest probability “80%”, the risk estimation unit 134 also indicates “illegal” as to the device to which the attack may transition. Suppose there is an intrusion.

Here, the risk estimation unit 134 can obtain the probability that an attack transits from the “server-S” to each device by using the hop count of the NW segment as a weight. In the example of FIG. 4, “(1/2) ^h−1 ” is selected as an example of weighting. “H” represents the number of hops described in the segment connection information table 121b (see FIG. 4). FIG. 15 is a diagram illustrating a method of calculating the attack transition probability. In this example, if the same NW segment is used, the probability of an attack transition is considered to be the same, and the probability of an attack transition decreases as the NW segment is different, in other words, the logically farther away. Therefore, the probability of attack transition to each device is calculated.

Specifically, as shown in FIG. 15, the probability Pb of transition from the event a to the event b is (1/2) ^{s in} the probability Pa of the event a when the number of hops of the events a and b is ^s. It will be the value multiplied by ^-1 . Similarly, the probability Pc of transitioning from the event a to the event c is a value obtained by multiplying the probability Pb by (1/2) ^t−1 , where t is the number of hops of the events a and c.

Therefore, the risk estimating unit 134 has the same probability as “unauthorized intrusion by the server-T” of the DMZ in the second stage of FIG. It gives a probability of “80%”. In addition, the risk estimating unit 134, regarding the probability of “unauthorized intrusion by the server-U” of the internal LAN in the second stage of FIG. 4, since the hop count is “3”, “80% of the“ server-S ” Is multiplied by (1/2) ² to give “20%”.

In this way, the risk estimation unit 134 appropriately estimates which device is receiving what type of attack and at what probability in the second stage processing. Furthermore, since the risk estimation unit 134 calculates the probability of attacking each device by weighting the number of hops, it is possible to obtain the probability of attacking each device that appropriately reflects the connection status of each device.

Subsequently, the risk estimation unit 134 executes the calculation process of the third stage. The risk estimation unit 134 estimates the probability of occurrence of damage assumed by the attack in the third stage. In this case, the risk estimation unit 134, in the third stage processing, the damage occurrence rate according to the content of damage and the type of attack, which is assumed in advance according to the intended use of each device, and the network obtained in the second step. And the probability of attack transition to the device in.

First, the risk estimation unit 134 refers to the device information table 121a of the device information storage unit 121, and determines, for each device, the purpose of use of the device for which an attack may transition from the “server-S” obtained in the second stage. To extract. Subsequently, the risk estimation unit 134 refers to the relationship presentation table 124a (see FIG. 7) between the purpose of use of the attribute information storage unit 124 and the damage as the processing of the next stage, and determines the purpose of use of each device. Extract the details of the damage.

For example, in the calculation process of the second stage, the risk estimation unit 134 determines that when “Server-S” is illegally intruded, “Server-T” and “Server-U” may also be illegally intruded. (See the second stage of FIG. 4). Therefore, in the third stage, the risk estimating unit 134 has the purpose of use of “server-T” and “server-U” as “service provision (application)” (see lines 2 and 3 in FIG. 3). Therefore, based on the relationship presentation table 124a (see FIG. 7) between the purpose of use and damage, "service A stop", "service A tampering", "service A information leak", etc. are assumed as damages. .. Similarly, the risk estimation unit 134 is assumed to be the “server-W” because the purpose of use of the “server-W” is “service provision (personal information, confidential information)” (fourth line in FIG. 3). As the damage, “file server tampering” and “file server information leakage” (the third line in FIG. 7) are requested.

Then, as a process of the third stage, the risk estimation unit 134, based on the attack type information table 124b (see FIG. 8) of the attribute information storage unit 124, the attack type for each device in which the transition of the attack is assumed. Calculate the probability of each damage caused by. Specifically, the risk estimation unit 134 calculates the probability of occurrence of each damage depending on the type of attack, based on the contents of the damage according to the purpose of use of each device, which is obtained from the relationship presentation table 124a between the purpose of use and the damage. , And the probability of occurrence of damage due to an attack is calculated by multiplying by the attack transition probability to each device obtained in the second stage, and the probability in the third stage is calculated.

Therefore, for example, with respect to the probability that the “service A is stopped”, the risk estimation unit 134 has a probability “60%” of damage “service stopped” by the attack type “illegal intrusion” (see the first line in FIG. 8). ) And the “80%” probability of “unauthorized intrusion by the server-T” obtained in the second stage (see FIG. 14, third stage, first stage).

Among the damages, it is necessary to determine the values of the falsification of the service and the information leakage of the service, because the probability values are calculated from multiple devices. FIG. 16 is a diagram illustrating a method of calculating the probability of occurrence of each damage depending on the type of attack. As shown in FIG. 16, in this example, as shown in FIG. 16, for example, the probability Pf of transition from the event d or the event e to the event f is calculated using the probability Pd of the event d and the probability Pe of the event e. , (1) can be calculated.

Therefore, for example, with respect to the probability that "falsification of service A" occurs, the risk estimation unit 134 has a probability of "falsification of service" "50%" due to the attack type "unauthorized intrusion" (see the second line of FIG. 8). ), And the probability “80%” of “unauthorized intrusion with Server-T” and “20%” of “unauthorized intrusion with Server-U” obtained in the second stage were applied to equation (1). “46%” is calculated (see the third stage, second stage in FIG. 14).

In this way, the risk estimation unit 134 appropriately calculates the concrete content of damage caused by the assumed attack and the probability of occurrence of each damage by performing the calculation process of the third stage.

Next, the risk estimation unit 134 acquires, as countermeasure information, the procedure for the attack type “unauthorized intrusion” from the countermeasure table 124c of the attribute information storage unit 124. Then, the risk estimation unit 134 displays and outputs the estimated attack, the probability of damage caused by the attack, and the acquired countermeasure information for the attack on the user terminal 20. FIG. 17 is a diagram showing an example of a screen displayed on the user terminal 20.

When the user checks and registers the confirmation event on the screen M1, the estimated attack and its probability (see Table L1) are estimated on the screen of the user terminal 20, as shown in the screen M2 of FIG. A device to which an attack is transited, an attack transition probability thereof (see Table L2), and possible measures against the attack (see region R2) are displayed.

In this way, the estimation device 10 estimates a device that may be attacked from input information such as user's declaration, server log and network monitoring tool log in response to a crisis such as a cyber incident. Then, the estimation device 10 specifically derives the damage assumed by the connection state between the device and another device in addition to the information such as the information owned by the device and the service provided by the device, and the damage status. Is provided to the user in a recognizable manner. Further, the estimation device 10 presents the user with countermeasures against the estimated attack.

Here, an example will be described in which the user checks the check box of possible “illegal intrusion” on the screen M2 and selects the countermeasure selection button. In this case, the countermeasure “attack” against the attack is transmitted from the user terminal 20 to the estimation device 10. In the estimation device 10, the incident information management unit 133 updates the countermeasure “illegal intrusion” (the countermeasure ID “1”) selected by the user in the countermeasure status report table 124e for the incident in the attribute information storage unit 124, and updates the registration date and time. It is registered together with the date and time and the attack type ID (see the first line in FIG. 11).

Then, the risk estimation unit 134 corrects the probability of occurrence of damage by the attack using the correction value according to the countermeasure transmitted from the user terminal 20. This is because if countermeasures are taken against an attack, the probability that the damage caused by the attack will occur will also change. Therefore, the correction processing by the risk estimation unit will be described.

First, the risk estimation unit 134 refers to the attack type information table 124d corresponding to the countermeasure in the attribute information storage unit 124, and extracts the probability of occurrence of damage corresponding to the selected countermeasure. The risk estimation unit 134 registers the damage occurrence probabilities for each attack type. In this example, the damage occurrence probabilities “x11” to “x3m” in the “measure 1” of the measure ID “1” are set. Extract.

FIG. 18 is a diagram illustrating a correction process by the risk estimation unit 134. As shown in FIG. 18, the risk estimation unit 134 calculates the value of each value extracted from the attack type information table 124d corresponding to the countermeasure plan (see Table L2-1) and the occurrence probability of each damage calculated in the third stage. The values (see Table L3-1) and are calculated by the Hadamard product shown in the equations (2) and (3), and the obtained value (z in the equation (2)) is the probability after the countermeasure is taken. Confirm as. For the sake of explanation, in Table L3-1, the value of the occurrence probability of each damage calculated in the third stage is associated with the attack types “1” to “3” and the damages “1” to “m”. Although “y11” to “y3m” are displayed, “y11” to “y3m” are “48%”, “46%”, and “62%” actually calculated in the third stage processing (see FIG. 14). Value of the third stage).

As described above, the risk estimating unit 134 can obtain the damage occurrence probability when the measure is selected by performing the correction process of the damage occurrence probability due to the attack according to the selected measure with high accuracy. . The risk estimating unit 134 causes the user terminal 20 to display and output the damage occurrence probability due to the corrected attack as the damage occurrence probability when the countermeasure is selected. FIG. 19 is a diagram showing an example of a screen displayed on the user terminal 20.

As shown in the screen M3 of FIG. 19, after the countermeasure “illegal intrusion” selected by the user is executed, the estimated damage occurrence rate is displayed in the table format on the user terminal 20 (Table L3). reference). The user can refer to the table L3 on the screen M3 to actually confirm the usefulness of the measure selected by the user, and then determine whether to execute the selected measure.

Then, the risk estimation unit 134 outputs the probability of each damage after implementation of the measures to the business impact degree calculation unit 136. Further, the external situation management unit 135 calculates a business impact index and outputs it to the business impact degree calculation unit 136.

Next, the process of calculating the business impact index by the external situation management unit 135 will be described. The external situation management unit 135 extracts the number of favorable articles, intermediate articles, and malicious articles from the headlines and contents of the articles of the company acquired by a service such as news article clipping, and uses them as indicators of the degree of influence. These articles are stored in the media trend evaluation information storage unit 125. For example, one of the three factors that determine reputational risk is the gap between reputation and reality. In this case, the external situation management unit 135 classifies the news article into three categories: positive news, neutral news, and negative news, and obtains the ratio of the news article to the total after it became public as a business impact index. , Get the degree of corporate image failure (business impact). For example, the business impact index is defined as shown in equation (4).

Note that the external situation management unit 135 has been described as an example of the case where the business impact index is obtained based on the news article, but the reputation index may be similarly obtained for social media. Further, the method of obtaining the business influence index required by the external situation management unit 135 is merely an example, and other indicators can be incorporated.

Subsequently, the business impact calculation unit 136 estimates the impact on the business of the service provided by the network due to the attack. Here, the business impact degree calculation unit 136 extracts the item regarding the impact on the business from the business impact table 127a regarding the service name of the company basic information storage unit 127, and calculates the impact degree on the service regarding the business.

For example, the case where "Server-S" is attacked is explained. In this case, the services that include “Server-S” as the target are those of “Company A”. For this reason, the business impact degree calculation unit 136 extracts the items necessary for calculating the impact degree on the business from the business impact table 127a regarding the service name. For example, the business impact degree calculation unit 136 determines that the number of personal information items is “e 10,000”, the personal information compensation amount is “f 100 yen”, the number of confidential information items is “g 100”, and the confidential information compensation amount is “h 10,000 yen”. The court costs “i million yen”, daily service sales “j billion yen”, impact on stock price “k%”, etc. are extracted. Then, the business impact degree calculation unit 136 calculates the personal information compensation amount, the confidential information compensation amount, the influence on sales, and the stock price drop amount using the expressions (5) to (8).

Subsequently, the business impact degree calculating unit 136 causes the risk estimating unit 134 to incur damages due to the corrected attack by the various amounts of money related to the impact on the business calculated using the equations (5) to (8), respectively. By multiplying the probabilities, various amounts of money related to the business impact of an attack after taking countermeasures are calculated.

At this time, the business impact calculation unit 136 may further multiply the calculation result by the business impact index output from the external situation management unit 135 as a weight. For example, the external situation management unit 135 can calculate the influence more suited to the social situation by multiplying the influence on the sales with the business influence index as a weight.

The business impact degree calculation unit 136 causes the user terminal 20 to display and output various estimated amounts of money regarding the impact on the business of the calculated attack. FIG. 20 is a diagram showing an example of a screen displayed on the user terminal 20.

As shown in the screen M4 of FIG. 20, after the countermeasure “illegal intrusion” selected by the user is executed, the effect on the business of the “illegal intrusion” attack is displayed in the table format on the user terminal 20. (See Table L4). The user can refer to the table L4 on the screen M4 to confirm the degree of influence on the business by the measure selected by the user in a concrete and multi-faceted manner.

Further, the business impact degree calculation unit 136 does not perform the processing of multiplying the occurrence probability of damage due to the corrected attack by the risk estimation unit 134, and the calculation result of the equations (5) to (8) as it is, that is, The result when the countermeasure “unauthorized intrusion” is not executed is displayed on the user terminal 20. By confirming this result on the screen of the user terminal 20, the user can confirm the degree of business impact when the countermeasure “unauthorized intrusion” is not executed.

As described above, in the estimation device 10, when the user has an observation event in which an attack occurs, countermeasures are taken against the predicted damage due to this attack, and countermeasures are taken against the attack. Specifically, indicate the degree of impact on the business if you do not execute.

[Processing procedure of estimation processing]
Subsequently, a processing procedure of the estimation processing according to the embodiment will be described. FIG. 21 is a sequence diagram showing an example of the flow of the estimation process according to the embodiment.

As shown in FIG. 21, when the device name in which the event is detected and the event confirmation date and time are transmitted by the user's input on the input screen of the user terminal 20 (steps S1 and S2), the process receiving unit 131. Accepts the input information and outputs the information to the system information management unit 132 (step S3).

The system information management unit 132 extracts the attribute value corresponding to the input device ID from the device information table 121a (see FIG. 3) in the device information storage unit 121 (step S4). The system information management unit 132 extracts the observation event from the observation event information table 122a (see FIG. 5) of the observation information storage unit 122 based on the extracted attribute value (step S5). The system information management unit 132 transmits an observation event display instruction to the screen of the user terminal 20 via the output unit 137 and the communication processing unit 11 (not shown) (steps S6 and S7).

As a result, the confirmation event is displayed on the screen of the user terminal 20 (step S8). When the confirmation event is registered by the operation of the user, in the estimation device 10, the process reception unit 131 receives the registered event (step S9) and outputs it to the incident information management unit 133 (step S10). The incident information management unit 133 refers to the observation event information table 122a, acquires the probability of an attack on the confirmation event and the probability calculation method (step S11), and calculates the attack occurrence rate (step S12). The incident information management unit 133 registers, in the incident information table 123a of the incident information storage unit 123, the type of attack on the first device in which the event was observed and the incidence of the attack (step S13), and The type of attack and the attack occurrence rate for the device No. 1 are output to the risk estimation unit 134 (step S14).

The risk estimation unit 134 divides this result into the second stage and the third stage, and calculates the probability of occurrence of damage due to an attack on the network device.

First, the risk estimation unit 134 may change (expand) the attack from the first device based on the segment connection information in the device information table 121a and the segment information connection table 122b of the device information storage unit 121. The device No. 2 is extracted (step S15). Then, the risk estimation unit 134 acquires the hop count of the first device from the device information storage unit 121 (step S16). The risk estimation unit 134 calculates the probability of an attack transitioning from the first device to the second device, using the hop count of the NW segment as a weight as shown in FIGS. 14 and 15 (step S17).

Then, the risk estimation unit 134 executes the calculation process of the third stage. In this case, the risk estimation unit 134 refers to the device information table 121a of the device information storage unit 121 and extracts the usage purpose of the second device for each device (step S18). Subsequently, the risk estimation unit 134 refers to the relationship presentation table 124a (see FIG. 7) between the use purpose and the damage of the attribute information storage unit 124 and the attack type information table 124b (see FIG. 8) to use each device. The contents of damage according to the purpose and the occurrence probability information of each damage for each attack type are extracted (step S19).

Based on the extracted information, the risk estimating unit 134 calculates the content of damage caused by the attack and the probability of occurrence of each damage for each device in which the transition of the attack is assumed (step S20). Specifically, the risk estimation unit 134 multiplies the occurrence probability of each damage depending on the type of attack extracted in step S19 and the attack transition probability to each device obtained in the second stage to determine the damage caused by the attack. The probability of occurrence is calculated and used as the probability in the third stage.

Subsequently, the risk estimation unit 134 acquires, as countermeasure information, a procedure for an attack on the first device from the countermeasure table 124c of the attribute information storage unit 124 (step S21). The risk estimation unit 134, via the output unit 137 and the communication processing unit 11, informs the user terminal 20 of an estimated attack, information indicating the probability of damage caused by the attack, and acquired countermeasure information for the attack. It is displayed (steps S22 and S23).

As a result, the screen of the user terminal 20 displays the estimated attack, the information indicating the probability of damage caused by the attack, and the acquired countermeasure information for the attack (step S24). When the countermeasure is selected by the user's operation, in the estimation device 10, the process reception unit 131 receives the selected event (step S25) and outputs it to the incident information management unit 133 (step S26). The incident information management unit 133 registers the selected countermeasure in the incident countermeasure status report table 124e of the attribute information storage unit 124 (step S27) and outputs the selected countermeasure to the risk estimation unit 134.

Subsequently, the risk estimation unit 134 refers to the attack type information table 124d corresponding to the countermeasure in the attribute information storage unit 124, and extracts the probability of occurrence of damage corresponding to the selected countermeasure (step S28). Then, the risk estimation unit 134 uses the extracted probability of occurrence of damage corresponding to the selected countermeasure plan as a correction value as described with reference to FIG. 18, and calculates the probability after the countermeasure is implemented (step S29). As a result, the risk estimation unit 134 corrects the damage occurrence probability due to the attack using the correction value according to the selected countermeasure.

The risk estimating unit 134 displays and outputs the probability of occurrence of damage due to the corrected attack on the user terminal 20 as the probability of occurrence of each damage after taking countermeasures (steps S30 and S31). As a result, the probability of damage occurring after the countermeasure selected by the user is executed is displayed on the screen of the user terminal 20 (step S32).

Subsequently, the risk estimation unit 134 outputs the probability of each damage after the countermeasure is implemented to the business impact degree calculation unit 136 (step S33). The external situation management unit 135 calculates the business impact index and outputs it to the business impact degree calculation unit 136 (step S35).

Then, the business impact degree calculation unit 136 extracts the enterprise basic information including the item regarding the impact on the business from the business impact table 127a regarding the service name of the enterprise basic information storage unit 127 (step S34). The business impact calculation unit 136 calculates the impact of the service on the business based on the probability of each damage after the countermeasures are taken and the business impact index (step S36). The business impact degree calculating unit 136 calculates the personal information compensation amount, the confidential information compensation amount, the impact on sales, the price drop amount, and the business impact degree regarding the service by using, for example, formulas (5) to (8). To do.

The business impact calculation unit 136 causes the user terminal 20 to display and output various estimated amounts of money regarding the impact of the calculated attack on the business (steps S37 and S38). As a result, the effect of the attack on the business is displayed on the user terminal 20 depending on whether or not the countermeasure selected by the user is executed (step S39). Further, the business impact degree calculation unit 136 registers the calculated impact degree of the attack on the business related to the service in the company basic information storage unit 127 (step S40), and ends the process.

[Effect of Embodiment]
As described above, the estimation device 10 according to the embodiment receives, as input from the user terminal 20, device information that identifies a device in the network and an observation event that has occurred in the device. Then, the estimation device 10 acquires the attribute information of the first device corresponding to the received device information, and estimates the risk of the device in the network being attacked based on the acquired attribute information and the received observation event. .. Based on the risk estimation result, the estimation device 10 estimates the impact on the business of the service provided by the network due to the attack on the device in the network, and calculates the impact on the business of the service, for example, It is output to the user terminal 20.

Therefore, according to the estimation device 10, in response to a crisis such as a cyber incident, the risk of the device in the network being attacked is estimated, and then the degree of impact of the attack on the business is provided to the user in a recognizable manner. .. As described above, in the embodiment, the user can appropriately grasp the damage in the real world by presenting the impact of the predicted damage on the business to the user at the time of predicting the damage. That is, according to the present embodiment, the user can grasp the influence of the attack on the business at an early stage when an observation event that is likely to lead to a cyber incident occurs. Therefore, the user can take an effective response to a cyber attack while considering the business impact.

[System configuration, etc.]
Further, each constituent element of each illustrated device is functionally conceptual, and does not necessarily have to be physically configured as illustrated. That is, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part of the device may be functionally or physically distributed / arranged in arbitrary units according to various loads or usage conditions. It can be integrated and configured. Further, each processing function performed in each device may be implemented entirely or in part by a CPU and a program that is analyzed and executed by the CPU, or may be realized as hardware by a wired logic.

Further, of the processes described in the present embodiment, all or part of the processes described as being automatically performed may be manually performed, or the processes described as being manually performed. All or part of the above can be automatically performed by a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above-mentioned documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
Further, it is also possible to create a program in which the process executed by the estimation device described in the above embodiment is described in a computer-executable language. For example, it is possible to create an estimation program in which a process executed by the estimation device 10 according to the embodiment is described in a computer-executable language. In this case, the computer executes the estimation program to obtain the same effect as that of the above-described embodiment. Further, by recording the estimation program in a computer-readable recording medium and causing the computer to read and execute the estimation program recorded in the recording medium, the same processing as that in the above-described embodiment may be realized. ..

FIG. 22 is a diagram showing a computer that executes the estimation program. As illustrated in FIG. 22, the computer 1000 has, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. However, these units are connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012, as illustrated in FIG. The ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090, as illustrated in FIG. The disk drive interface 1040 is connected to the disk drive 1100, as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052, as illustrated in FIG. The video adapter 1060 is connected to, for example, the display 1061 as illustrated in FIG.

Here, as illustrated in FIG. 22, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above estimation program is stored in, for example, the hard disk drive 1090 as a program module in which a command executed by the computer 1000 is described.

The various data described in the above embodiments are stored as program data in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes various processing procedures.

The program module 1093 and the program data 1094 related to the estimation program are not limited to being stored in the hard disk drive 1090, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive or the like. Good. Alternatively, the program module 1093 and the program data 1094 related to the estimation program are stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.) and read by the CPU 1020 via the network interface 1070. May be done.

10 Estimator 11 Communication processing unit 12 Storage unit 13 Control unit 121 Device information storage unit 122 Observation information storage unit 123 Incident information storage unit 124 Attribute information storage unit 125 Media trend evaluation information storage unit 126 Social media analysis information storage unit 127 Corporate foundation Information storage unit 131 Process reception unit 132 System information management unit 133 Incident information management unit 134 Risk estimation unit 135 External situation management unit 136 Business impact calculation unit 137 Output unit 20 User terminal 30 Connection line

Claims (7)

1. An estimation method executed by an estimation device, comprising:
   A receiving step of receiving device information for identifying a device in the network and an observation event occurring in the device as input from the terminal;
   The attribute information of the first device corresponding to the device information received in the receiving step is acquired, and the device in the network is attacked based on the acquired attribute information and the observation event received in the receiving step. A first estimation step for estimating risk,
   A second estimating step of estimating, based on the estimation result of the first estimating step, a degree of influence on a business regarding a service provided by the network due to an attack on a device in the network;
   A first output step of outputting the estimation result estimated in the second estimation step;
   An estimation method characterized by including.
2. In the first estimating step, an attack transition probability from the first device to a second device in which an attack is likely to make a transition is obtained based on the segment connection information, and the use purpose of each device assumed in advance is obtained. Based on the damage content and the attack probability depending on the type of the attack, and the attack transition probability to the second device, the attack damage probability is estimated,
   In the second estimating step, based on various kinds of information that each service affects, regarding the service provided by the network, a monetary amount related to the business impact due to damage caused by the attack is calculated, and the calculated monetary amount and the attack. The estimation method according to claim 1, wherein the degree of influence on the business is estimated using a probability of occurrence of damage due to.
3. In the second estimating step, an amount obtained by multiplying the obtained amount by the probability of occurrence of damage by the attack is multiplied by a business influence index based on an external situation as a weight to obtain the degree of influence on the business. The estimation method according to claim 2, which is characterized in that
4. The said 1st estimation process calculates | requires the attack transition probability to the said 2nd apparatus by multiplying the attack probability of a transition source apparatus as a weighting based on the value based on a hop number. Estimation method.
5. A second output step of outputting to the terminal a probability of damage caused by the attack, and a countermeasure against the attack;
   When a countermeasure selected from the terminal is received, a correction step of correcting the occurrence probability of damage due to the attack using a correction value according to the received countermeasure,
   A third output step of outputting to the terminal the probability of occurrence of damage caused by the attack corrected in the correction step;
   The estimation method according to claim 2, further comprising:
6. A device that receives device information for identifying a device in the network and an observation event that has occurred in the device as an input from the terminal,
   The attribute information of the first device corresponding to the device information received by the reception unit is acquired, and the device in the network is attacked based on the acquired attribute information and the observation event received by the reception unit. A first estimation unit for estimating risk,
   A second estimating unit that estimates the degree of influence on the business regarding the service provided by the network due to the attack on the device in the network based on the estimation result by the first estimating unit;
   An output unit that outputs the estimation result estimated by the second estimation unit;
   An estimation device comprising:
7. A receiving step of receiving device information for identifying a device in the network and an observation event occurring in the device as input from the terminal;
   The attribute information of the first device corresponding to the device information received in the receiving step is acquired, and the device in the network is attacked based on the acquired attribute information and the observation event received in the receiving step. A first estimation step of estimating risk,
   A second estimating step of estimating, based on the estimation result in the first estimating step, a degree of influence on a business regarding a service provided by the network due to an attack on a device in the network;
   An output step of outputting the estimation result estimated in the second estimation step,
   An estimation program characterized by causing a computer to execute.

Images