WO2021144978A1

WO2021144978A1 - Attack estimation device, attack estimation method, and attack estimation program

Info

Publication number: WO2021144978A1
Application number: PCT/JP2020/001555
Authority: WO
Inventors: 久詞内藤
Original assignee: 三菱電機株式会社
Priority date: 2020-01-17
Filing date: 2020-01-17
Publication date: 2021-07-22

Abstract

When an event is detected to have occurred in a terminal device in which one or more tools are installed, the event relating to the security of the terminal device, a tool estimation unit (110) estimates an event-involved tool, which is a tool that may have been involved in the occurrence of the event, among the one or more tools. Moreover, when an event is detected to have occurred in the terminal device in which the one or more tools are installed, the event relating to the security of the terminal device, an assessment unit (111) uses the event-involved tool estimated by the tool estimation unit to assess the possibility that the event occurred due to a cyberattack.

Description

Attack estimation device, attack estimation method and attack estimation program

This disclosure relates to an attack estimation device, an attack estimation method, and an attack estimation program.

Due to changes in the environment surrounding companies in recent years, corporate information security risks have diversified and changed in quality. Today, information security incidents that lead to troubles related to information assets such as leakage of important information due to cyber attacks, unauthorized access, and system failures are occurring frequently, and it is difficult to completely prevent the occurrence of incidents. ing. Therefore, in addition to security monitoring, companies are required to have a high ability to respond in the event of an incident by strengthening regulatory aspects.

If the response to the incident is delayed, the damage will increase and the loss suffered by the company will be enormous. Therefore, when an information security-related event that may be an information security incident is detected, the company must promptly determine whether or not the event was caused by a cyber attack. Furthermore, if it is determined that the event was caused by a cyber attack, the company must promptly identify the infection route, take measures to prevent the spread of damage, and maintain the business.

However, there are only a limited number of security personnel with advanced skills who can immediately respond to incidents caused by advanced threats, and how limited personnel can cause information security-related events. The issue is how to respond quickly at times. Against this background, technologies that can realize high responsiveness even without human resources with advanced skills have been proposed.

In Patent Document 1, a behavior pattern showing a trace indicating a cyber attack is registered in advance. In addition, the behavior of the process running on the terminal is recorded. Then, a method of detecting an attack event has been proposed by determining that an attack has been performed when a behavior matching the registered behavior pattern is found in the record.

Japanese Unexamined Patent Publication No. 2010-0922174

Patent Document 1 defines in advance information indicating a trace of an attack that remains when a cyber attack occurs, and confirms whether the log recorded by the device contains information that matches the information indicating the trace. It is a signature-based method that detects attack events. However, in the signature-based method, when a tool installed as standard in the OS (Operating System) or a tool approved for use by a company (hereinafter referred to as a regular tool) is abused, a cyber attack event is detected. There is a problem that it cannot be detected properly.
As a specific example, in the detection method using the operation pattern of the legitimate tool, the operation of the legitimate tool due to the activity of the legitimate user may match the operation pattern of the attack, and false detection of the attack event may occur. In addition, the operation of the legitimate tool due to the activity of the legitimate user may be mixed with the operation of the legitimate tool due to the cyber attack, and the operation pattern may not be properly discovered and the detection of the attack event may be omitted.

One of the main purposes of this disclosure is to solve the above problems, and the main purpose is to appropriately detect the event of a cyber attack even when a legitimate tool is used for the cyber attack. And.

The attack estimation device according to the present disclosure is
When it is detected that an event related to the security of a terminal device in which one or more tools are installed has occurred in the terminal device.
Among the one or more tools, a tool estimation unit that estimates an event-related tool that may have been involved in the occurrence of the event, and a tool estimation unit.
It has a determination unit for determining the possibility that the event has occurred due to a cyber attack by using the event involvement tool estimated by the tool estimation unit.

According to this disclosure, even when a legitimate tool is used for a cyber attack, the event of the cyber attack can be appropriately detected.

The figure which shows the configuration example of the attack estimation system which concerns on Embodiment 1. FIG. The figure which shows the configuration example of the hardware of the attack estimation apparatus which concerns on Embodiment 1. FIG. The figure which shows the functional configuration example of the attack estimation apparatus which concerns on Embodiment 1. FIG. The figure which shows the example of the tool information which concerns on Embodiment 1. FIG. The flowchart which shows the operation example of the attack estimation apparatus which concerns on Embodiment 1. The figure which shows the functional configuration example of the attack estimation apparatus which concerns on Embodiment 2. FIG. The figure which shows the example of the attack tree information which concerns on Embodiment 2. The figure which shows the example of the attack tree which concerns on Embodiment 2. The flowchart which shows the operation example of the attack estimation apparatus which concerns on Embodiment 2.

Hereinafter, embodiments will be described with reference to the drawings. In the following description and drawings of the embodiments, those having the same reference numerals indicate the same parts or corresponding parts.
In the first embodiment, an example will be described assuming a business of detecting a cyber attack event in the SOC (Security Operation Center) business.

Embodiment 1.
*** Explanation of configuration ***
FIG. 1 is a diagram showing a configuration of an attack estimation system 1 according to the present embodiment.
The control system 1 includes an attack estimation device 10, a target system 20, and a network 30.

The attack estimation device 10 performs attack estimation for estimating whether or not a security-related event generated in the target system 20 is caused by a cyber attack. The attack estimation device 10 is connected to the target system 20 via the network 30.
The operation procedure of the attack estimation device 10 corresponds to the attack estimation method. Further, the program that realizes the operation of the attack estimation device 10 corresponds to the attack estimation program.

The target system 20 includes one or more terminal devices 21. Further, the terminal device 21 is installed in a company, a school, or the like and is used by a regular user. Specific examples of the terminal device 21 are a PC (Personal Computer), a server, a workstation, a tablet, a smartphone, a mobile phone, and the like.

The network 30 is an information communication network for data communication between devices. The network 30 is, for example, a local area network such as a company or a school, a wide area network, or the Internet.

FIG. 2 is a diagram showing a hardware configuration example of the attack estimation device 10 according to the present embodiment.
The attack estimation device 10 is a computer. The attack estimation device 10 includes a processor 11, a memory device 12, an auxiliary storage device 13, a drive device 14, a communication interface 16, and a display device 17 as hardware, and is connected to each other by a signal line.

The processor 11 is an IC (Integrated Circuit) that performs processing. Specific examples of the processor 11 include a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and the like.

The memory device 12 temporarily stores data. As a specific example, the memory device 12 is a RAM (Random Access Memory).

The auxiliary storage device 13 stores data. As a specific example, the auxiliary storage device 13 is a hard disk.
The auxiliary storage device 13 includes SSD (registered trademark, Solid State Drive), SD (registered trademark, Secure Digital) memory card, CF (registered trademark, CompactFlash), NAND flash, flexible disk, optical disk, compact disk, and Blu-ray (registered trademark, Secure Digital) memory card. It may be a portable recording medium such as a registered trademark) disc or a DVD (registered trademark, Digital Versaille Disk).
A program that realizes the functions of the receiving unit 100, the processing unit 101, and the output unit 102, which will be described later, is installed in the auxiliary storage device 13. Then, when the program start instruction is given, the program that realizes the functions of the receiving unit 100, the processing unit 101, and the output unit 102 installed in the auxiliary storage device 13 is loaded into the memory device 12 and read by the processor 11. And executed.
The OS is also stored in the auxiliary storage device 13.
Then, at least a part of the OS is executed by the processor 11.
The processor 11 executes a program that realizes the functions of the receiving unit 100, the processing unit 101, and the output unit 102 while executing at least a part of the OS.
When the processor 11 executes the OS, task management, memory management, file management, communication control, and the like are performed.

Further, at least one of the information, data, signal value, and variable value indicating the processing result of the receiving unit 100, the processing unit 101, and the output unit 102 is a register in the processor 11, the memory device 12, and the auxiliary storage device 13. It is stored in at least one of the cache memories.

The drive device 14 transfers data.

The recording medium 15 is a portable recording medium that stores a program that realizes the functions of the receiving unit 100, the processing unit 101, and the output unit 102. Specific examples include hard disks, SSDs (registered trademarks), SD (registered trademarks) memory cards, CF (registered trademarks), NAND flashes, flexible disks, optical disks, compact discs, Blu-ray (registered trademarks) disks, and DVDs (registered trademarks). Is.
The recording medium 15 storing the program is set in the drive device 14, and when the program installation instruction is given, the program is installed in the auxiliary storage device 13 from the recording medium 15 via the drive device 14.

However, the program does not necessarily have to be installed using the recording medium 15, and may be downloaded from another computer via the network 30 or the like.

The communication interface 16 is an electronic circuit that executes data communication processing with the connection destination. As a specific example, the communication interface 16 is a communication chip for Ethernet (registered trademark) or a NIC (Network Interface Card).

The display device 17 displays the result of the attack estimation of the attack estimation device 10.

The attack estimation device 10 may be composed of a plurality of computers having the hardware as shown in FIG. That is, the processing executed by the attack estimation device 10 may be distributed to a plurality of computers and executed.

FIG. 3 is a diagram showing a functional configuration example of the attack estimation device 10 according to the present embodiment.
The attack estimation device 10 includes a receiving unit 100, a processing unit 101, an output unit 102, a system configuration information storage unit 120, and a tool information storage unit 121. Further, the processing unit 101 includes a tool estimation unit 110 and a determination unit 111.

The receiving unit 100 receives a notification notifying that an event related to security has been detected, and an operation history and an operation record of the tool in the terminal device 21 in which the event has occurred.
The processing unit 101 estimates an attack of a security-related event that has occurred in the terminal device 21.
The tool estimation unit 110 estimates an event-related tool, which is a regular tool that may have been involved in a security-related event that occurred in the terminal device 21, based on the operation record of the tool and the tool information.
The process performed by the tool estimation unit 110 corresponds to the tool estimation process.
The determination unit 111 determines the possibility that an event related to the security of the terminal device 21 has occurred due to a cyber attack by using the event involvement tool estimated by the tool estimation unit 110.
The process performed by the determination unit 111 corresponds to the determination process.
The output unit 102 outputs the result estimated by the processing unit 101.

The system configuration information storage unit 120 stores the information of the terminal device 21 belonging to the target system 20.
The tool information storage unit 121 stores tool information related to a regular tool such as a tool installed as standard in the terminal device 21 or a tool approved for use in daily business. Details of the tool information will be described later.
The system configuration information storage unit 120 and the tool information storage unit 121 are realized by the memory device 12 and the auxiliary storage device 13.

The "unit" of the receiving unit 100, the processing unit 101, and the output unit 102 may be read as "circuit" or "process" or "procedure" or "processing".
Further, the attack estimation device 10 may be realized by a processing circuit. The processing circuit is, for example, a logic IC (Integrated Circuit), a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array).
In this case, the receiving unit 100, the processing unit 101, and the output unit 102 are each realized as a part of the processing circuit.
In this specification, the superordinate concept of the processor and the processing circuit is referred to as "processing circuit Lee".
That is, the processor and the processing circuit are specific examples of the "processing circuit Lee", respectively.

FIG. 4 shows an example of the tool information T10 according to the present embodiment.
The tool information storage unit 121 stores the tool information T10 shown in FIG.
In the example of FIG. 4, in the tool information T10, in order from the leftmost column, the tool ID which is the identifier of the legitimate tool, the name of the legitimate tool, the frequency of use of the legitimate tool used in the cyber attack in the past, and the legitimacy in the past. The frequency of use of the tool by legitimate users is shown.

The tool information T10 is information registered in advance by the administrator of the attack estimation system 1, a security expert, or the like.
The frequency of use used for cyber attacks and the frequency of use used by legitimate users are determined based on the information collected by the administrator of the attack estimation system 1, a security expert, or the like.
In the present embodiment, one tool information T10 is registered for the target system 20, but the present invention is not limited to this, and a plurality of such information may be registered for each terminal device 21 or for each base where a plurality of terminal devices 21 are installed. Tool information T10 may be prepared and registered.

In the example of FIG. 4, the standard command line tool of Windows (registered trademark), tasklist, is registered as tool ID: A50020, tool name: tasklist, attack usage frequency: high, and regular user usage frequency: low. Indicates that you are. It also indicates that the net use is registered as a tool ID: A50021, a tool name: net use, an attack usage frequency: high, and a legitimate user usage frequency: low.
In the example of FIG. 4, the value indicating the frequency of use is two values of high and low, but the value is not limited to this, and a value of two or more values may be used, or a numerical value may be used to indicate the value.

*** Explanation of operation ***
Next, an operation example of the attack estimation device 10 according to the present embodiment will be described with reference to the flowchart of FIG.
In the present embodiment, the attack estimation device 10 receives a notification notifying the occurrence of an event related to the security of the terminal device 21 and the operation history and operation record of the tool installed in the terminal device 21, and estimates the attack. An example to be performed will be described.
The operation history is a history in which a legitimate user of the terminal device 21 operates the tool, and as a specific example, it is recorded using a hardware-based input operation recording device or the like, which is difficult to be tampered with by malware or the like of a cyber attack. Operation history. Alternatively, the operation history may be an operation history recorded when a confirmation dialog is displayed when the tool is operated and the user permits the operation on the GUI (Graphic User interface).
The operation history is an operation record of the tool recorded at the OS level.

First, in step S100, the receiving unit 100 receives a notification notifying that a security-related event has occurred. In addition, the receiving unit 100 receives the operation history and operation record of the tool.
Then, the receiving unit 100 notifies the processing unit 101 of information such as the received notification, the operation history, and the operation record.

Next, in step S110, the tool estimation unit 110 confirms whether or not the information received by the reception unit 100 is information related to the terminal device 21 registered in the system configuration information storage unit 120.
If the tool estimation unit 110 confirms that the information received by the reception unit 100 is that of the terminal device 21 registered in the system configuration information storage unit 120, the tool estimation unit 110 searches for the operation record received by the reception unit 100 and causes an event. Extract tools that were operated during a certain period of time before the occurrence of. The fixed period is a period designated in advance by the operator, and specific examples thereof are several hours, several days, and the like.
Further, the tool estimation unit 110 refers to the tool information T10 stored in the tool information storage unit 121, and among the extracted tools, the tool registered in the tool information T10 is involved in an event that may have been involved in the event. Presumed to be a tool. Then, the tool estimation unit 110 notifies the determination unit 111 of the tool name of the event-related tool, the frequency of use used in the cyber attack in the past, and the frequency of use used by the legitimate user in the past as the estimation result.
On the other hand, if the tool estimation unit 110 confirms that the information received by the reception unit 100 is not the information related to the terminal device 21 registered in the system configuration information storage unit 120, the tool estimation unit 110 waits until the information of the terminal device 21 is received.

Next, in step S120, the determination unit 111 determines the possibility that the event has occurred due to a cyber attack based on the estimation result of the event-related tool notified by the tool estimation unit 110.
Specifically, the determination unit 111 compares the frequency of use of the event-related tool in the past for cyber attacks with the frequency of use in the past by legitimate users. Then, if the frequency of use used in the cyber attack is higher than the frequency of use by the legitimate user, the process proceeds to step S160.
On the other hand, if the frequency of use used for the cyber attack is the same or lower than the frequency of use used by the legitimate user, the process proceeds to step S130.
In the present embodiment, the determination unit 111 determines the possibility that the event has occurred due to the cyber attack based on the frequency of use used for the cyber attack in the past and the frequency of use used by the legitimate user in the past. An example will be described. However, the present invention is not limited to this, and the determination unit 111 may determine the possibility that the event has occurred due to the cyber attack based only on the frequency of use used for the cyber attack in the past.

Next, in step S130, the determination unit 111 confirms the operation history and the operation record of the event-related tool.
More specifically, the determination unit 111 confirms the operation time and operation content of the event-related tool in the operation history and the operation time and operation content of the event-related tool.

Next, in step S140, the determination unit 111 determines whether the recorded operation of the event-related tool matches the operation of the regular user based on the confirmation result of the operation history of the event-related tool and the operation record.
If the recorded action of the event-related tool matches the action of the legitimate user, the process proceeds to step S150.
On the other hand, if the recorded operation of the event involvement tool does not match the operation by the operation of the regular user, the process proceeds to step S160.

Next, in step S150, the determination unit 111 determines that the event involvement tool is not involved in the event and that there is no possibility that a cyber attack has occurred. Then, the determination unit 111 notifies the output unit 102 of the determination result.

Next, in step S160, the determination unit 111 determines that the event involvement tool is involved in the event and that a cyber attack may have occurred. Then, the determination unit 111 notifies the output unit 102 of the determination result.

Then, in step S170, the output unit 102 notified from the determination unit 111 outputs the estimation result to the display device 17. Further, the output unit 102 may store the estimation result in the auxiliary storage device 13, or may transmit the estimation result to the connection destination via the communication interface 16.

*** Explanation of the effect of the embodiment ***
Based on the above, in the present embodiment, when a security-related event is detected, a legitimate tool that may have been involved in the event is presumed. Then, it is determined whether or not the estimated legitimate tool may have been used in a cyber attack. Therefore, even when a legitimate tool is used for a cyber attack, the event of the cyber attack can be appropriately detected.
In this embodiment, an example of performing attack estimation triggered by receiving information for detecting a security-related event has been described. However, the present invention is not limited to this, and the attack estimation device 10 may have an event detection function related to the security of the terminal device 21, and the attack estimation may be performed when the detection function is detected.

Embodiment 2.
In this embodiment, an example of estimating an attack route using an attack tree will be described.
In the attack tree, the threat that is the ultimate target of the cyber attack is the root node, and the attacks that may be executed in stages until the threat of the root node is generated are the leaf nodes or internal nodes that connect to the root node. It is the information of the tree structure.
The attack route estimation according to the present embodiment determines whether or not an attack route via each node constituting the attack tree is established, and each node determined to pass is based on the connection relationship between the nodes. The process of estimating the attack route indicated by connecting is shown.
In this embodiment, the difference from the first embodiment will be mainly described.
The matters not explained below are the same as those in the first embodiment.

FIG. 6 is a functional configuration diagram of the attack estimation device 10 according to the present embodiment.
In the present embodiment, the attack estimation device 10 newly includes a route estimation unit 112 and an attack tree information storage unit 122.
The route estimation unit 112 estimates the attack route based on the attack tree information. A detailed explanation of the attack tree information will be described later.
The "part" of the route estimation unit 112 may be read as "circuit" or "process" or "procedure" or "processing".
Further, when the attack estimation device 10 is realized by the processing circuit, the route estimation unit 112 is realized as a part of the processing circuit.
The attack tree information storage unit 122 is a storage area for storing attack tree information. Further, the attack tree information storage unit 122 is realized by the memory device 12 and the auxiliary storage device 13.
Further, in the present embodiment, in addition to the information received in the first embodiment, the receiving unit 100 also receives the attack information of the cyber attack confirmed to have occurred in the target system 20. The attack information is the attacked terminal device and attack means.
The same components as those in the first embodiment are designated by the same numbers, and the description thereof will be omitted.

FIG. 7 shows an example of the attack tree information T20 according to the present embodiment.
The attack tree information storage unit 122 stores the attack tree information T20 shown in FIG. 7.
The attack tree information T20 is composed of a plurality of node information. Then, the node information indicates the terminal device to be attacked, the attack means, and the connection relationship between the nodes.
Specifically, in the example of the attack tree information T20 of FIG. 7, as the node information, the node ID which is the identifier of the node, the device ID which is the identifier of the terminal device 21 which is the target of the attack, and the node are ordered from the leftmost column. The branching condition to the child node located below the node, the parent node ID of the parent node located above the node, and the attack means are shown.
The branching condition to the child node is OR or AND. When the branching condition is OR, it indicates that an attack route via at least one of a plurality of child nodes may be established. Further, when the branch condition is AND, it is shown that an attack route passing through all of a plurality of child nodes may be established.

In the example of FIG. 7, the attack that is the final target of the cyber attack is node ID: 1, device ID: D, branch condition:-(no branch condition), parent node ID:-(no parent node), attack means: Indicates that the customer information is deleted and registered as. In addition, one of the attacks that may be executed step by step until the final target attack is node ID: 1, 1, device ID: D, branch condition: OR, parent node ID: 1, attack means: It indicates that it is registered as an intrusion using "OS vulnerability X".
In the example of FIG. 7, it is shown that the node whose node ID is represented by one integer is the root node. Therefore, node ID: 1 indicates that it is a root node. On the other hand, node IDs: 1 and 1, whose node IDs are represented by two integers separated by commas, indicate that they are leaf nodes or internal nodes, not root nodes.

FIG. 8 shows an attack tree 200 represented based on the attack tree information T20. The attack tree 200 is expressed based on node IDs: 1,1 to 1,1,1,1,1,1 leaf nodes and internal nodes, with node ID: 1 as the root node of the apex, and their connection relationships. It is a tree.
Then, the attack route is shown by connecting the leaf node and the internal node determined to pass through to the root node based on the connection relationship between the nodes.

The attack tree information T20 is information registered in advance by the administrator of the attack estimation system 1 or a security expert.
In the present embodiment, one attack tree information T20 is registered for the target system 20, but the attack tree information T20 is not limited to that, and a plurality of attack tree information T20 is prepared for each attack which is the final target of the attack. , May be registered.

Next, an operation example of the attack estimation device 10 according to the present embodiment will be described with reference to the flowchart of FIG.
In the present embodiment, an example will be described in which the route estimation unit 112 starts the attack route estimation when the reception unit 100 receives the attack information via the communication interface 16.
However, the trigger for starting the attack route estimation is not limited to the reception of the attack information of the receiving unit 100, and the determination that there is a possibility of an attack by the determination unit 111 in the attack estimation may be used.

First, in step S200, the receiving unit 100 receives the attack information.
Then, the receiving unit 100 notifies the processing unit 101 of the received attack information.

Next, in step S210, the route estimation unit 112 confirms whether or not the attack information received by the reception unit 100 is information related to the terminal device 21 registered in the system configuration information storage unit 120.
If the route estimation unit 112 confirms that the attack information received by the reception unit 100 is information related to the terminal device 21 registered in the system configuration information storage unit 120, the attack tree stored in the attack tree information storage unit 122 See information T20. Then, the route estimation unit 112 searches for the attack tree information T20 and extracts the root node corresponding to the attack information received by the reception unit 100.
On the other hand, if the route estimation unit 112 confirms that the attack information received by the reception unit 100 is not the information related to the terminal device 21 registered in the system configuration information storage unit 120, the route estimation unit 112 waits until the information of the terminal device 21 is received. ..
When the attack estimation determination is used as the trigger for starting the attack route estimation, the route estimation unit 112 searches for the attack tree information T20 and uses the terminal device 21 on which the attack estimation is performed and the estimated event involvement tool. Extract the root node corresponding to the attack method.
Then, if the root node can be extracted, the process proceeds to step S220. On the other hand, if there is no root node corresponding to the attack information received by the receiving unit 100 and the root node cannot be extracted, the process proceeds to step S270.

Next, in step S220, the route estimation unit 112 selects one root node from the extracted root nodes.
When the process returns from step S260, the route estimation unit 112 selects one unselected root node from the extracted root nodes.
When there are a plurality of root nodes that can be selected, the route estimation unit 112 may select the node IDs in ascending order of numbers.

Next, in step S230, the route estimation unit 112 designates one descendant node of the descendant nodes of the selected root node.
When the process returns from step S250, the route estimation unit 112 specifies one of the descendant nodes of the selected root node that has not performed the establishment determination of the attack route via the node.
When there are a plurality of descendant nodes that can be specified, the route estimation unit 112 may specify the node IDs in ascending order of numbers.

Next, in step S240, the route estimation unit 112 determines whether an attack route via the node is established.
Specifically, the route estimation unit 112 confirms whether or not the information corresponding to the attack indicated by the node specified in the attack information received by the reception unit 100 exists.
Then, when the route estimation unit 112 confirms that the information corresponding to the attack indicated by the designated node exists, the route estimation unit 112 determines that the attack route via the node is established.
On the other hand, when the route estimation unit 112 cannot confirm that the information corresponding to the attack indicated by the designated node exists, the route estimation unit 112 causes the tool estimation unit 110 to perform attack estimation on the terminal device 21 indicated by the designated node. Notify and start attack estimation.
Since the attack estimation according to the present embodiment is the same process as that of the first embodiment, the description thereof will be omitted.
Then, based on the attack estimation, the route estimation unit 112 determines that the attack route via the node is established when it is estimated that there is a possibility of an attack shown to the designated node.
On the other hand, if it is estimated that there is no possibility of an attack shown to the designated node, the route estimation unit 112 determines that the attack route via the node is not established. In addition, it is determined that the attack route via all the descendant nodes of the node determined not to be established is not established.

Next, in step S250, the route estimation unit 112 determines whether or not the next designated node exists among the descendant nodes of the selected root node.
Specifically, the route estimation unit 112 confirms whether or not there is a node among the descendant nodes of the selected root node that has not performed the establishment determination of the attack route via the node in step S240. Then, if there is a node that has not performed the establishment determination of the attack route via the node, the process returns to step S230.
On the other hand, if there is no node for which the route estimation unit 112 has not executed the establishment determination of the attack route via the node, the process proceeds to step S260.

Next, in step S260, the route estimation unit 112 determines whether or not the root node to be selected next exists.
Specifically, the route estimation unit 112 confirms whether or not there is a root node not selected in the process of step S220 among the root nodes extracted in the process of step S210.
Then, if there is a root node that has not been selected, the process returns to step S220.
On the other hand, if there is no unselected root node, the process proceeds to step S270.

Then, in step S270, the route estimation unit 112 notifies the output unit 102 of the node information of the root node and the descendant node that is supposed to pass through as a result of the attack route estimation. Then, the output unit 102 connects the root node and a plurality of descendant nodes that are supposed to pass through based on the result of the attack route estimation notified to the route estimation unit 112 based on the connection relationship between the nodes. The route is output to the display device 17 as an estimated attack route.
Further, the output unit 102 may store the estimated attack route in the auxiliary storage device 13, or may transmit the estimated attack route to the connection destination via the communication interface 16.
The output unit 102 may divide one attack route into a plurality of attack routes and output it based on the branching condition between the parent node and the child node. As a specific example, when a parent node and a plurality of child nodes whose branching conditions between nodes are OR exist in the estimated attack route, even if a plurality of attack routes branched to each child node are output respectively. good.

As described above, in the present embodiment, the attack route can be estimated by connecting the confirmed attack and the estimated attack based on the relationship between the attacks using the attack tree. Therefore, according to the present embodiment, it is possible to detect a complex cyber attack event by a multi-stage attack including an attack in which a legitimate tool is used for the cyber attack.
In this embodiment, an example of estimating the attack route using the received attack information has been described. However, the present invention is not limited to this, and the attack estimation device 10 may have a function of collecting attack information, and the attack route may be estimated using the collected attack information.

Although the embodiments have been described above, these two embodiments may be combined and implemented.
Alternatively, one of these two embodiments may be partially implemented.
Alternatively, these two embodiments may be partially combined and implemented.
It should be noted that the present invention is not limited to these embodiments, and various changes can be made as needed.

1 attack estimation system, 10 attack estimation device, 11 processor, 12 memory device, 13 auxiliary storage device, 14 drive device, 15 recording medium, 16 communication interface, 17 display device, 20 target system, 21 terminal device, 30 network, 100 Reception unit, 101 processing unit, 102 output unit, 110 tool estimation unit, 111 judgment unit, 112 route estimation unit, 120 system configuration information storage unit, 121 tool information storage unit, 122 attack tree information storage unit, 200 attack tree, T10 Tool information, T20 attack tree information.

Claims

When it is detected that an event related to the security of a terminal device in which one or more tools are installed has occurred in the terminal device.
Among the one or more tools, a tool estimation unit that estimates an event-related tool that may have been involved in the occurrence of the event, and a tool estimation unit.
An attack estimation device having a determination unit for determining the possibility that the event has occurred due to a cyber attack using the event involvement tool estimated by the tool estimation unit.
The determination unit
The attack estimation device according to claim 1, wherein the event involvement tool determines the possibility that the event has occurred due to a cyber attack based on the frequency of being used for a cyber attack in the past.
The determination unit
By comparing the frequency with which the event-related tool was used in a cyber attack in the past and the frequency with which the event-related tool was used by a legitimate user in the past, it is possible that the event was caused by a cyber attack. The attack estimation device according to claim 1.
The determination unit
Based on the operation history, which is the history of the operation of the event-related tool in the terminal device, and the operation record in which the operation of the event-related tool is recorded, the possibility that the event has occurred due to a cyber attack is determined. The attack estimation device according to claim 1.
The attack estimation device further
It has a route estimation unit that estimates the attack route of the cyber attack to the terminal device by using the attack tree when the determination unit determines that the event may have occurred due to the cyber attack. The attack estimation device according to claim 1.
When the computer detects that a security-related event in a terminal device with one or more tools installed has occurred in the terminal device.
Among the one or more tools, the event involvement tool, which is a tool that may have been involved in the occurrence of the event, is estimated.
An attack estimation method in which the computer uses the estimated event involvement tool to determine the possibility that the event has occurred due to a cyber attack.
When it is detected that an event related to the security of a terminal device in which one or more tools are installed has occurred in the terminal device.
Among the one or more tools, a tool estimation process for estimating an event-related tool, which is a tool that may have been involved in the occurrence of the event, and a tool estimation process.
An attack estimation program that causes a computer to execute a determination process for determining the possibility that the event has occurred due to a cyber attack using the event involvement tool estimated by the tool estimation process.