WO2023012849A1

WO2023012849A1 - Inference device, inference method, and storage medium

Info

Publication number: WO2023012849A1
Application number: PCT/JP2021/028549
Authority: WO
Inventors: 庄太本浦
Original assignee: 日本電気株式会社
Priority date: 2021-08-02
Filing date: 2021-08-02
Publication date: 2023-02-09
Also published as: JPWO2023012849A1

Abstract

In this inference device, an inference means performs an inference process based on an observation log which is obtained by recording information relating to a cyber attack and a feature of the attacker which is analogous to a past attack case, whereby the inference means acquires a complete picture of the attack by the attacker in which the modus operandi of the attack is hierarchically abstracted when it is supposed that the attacker has left information corresponding to the observation log. A similarity score acquisition means acquires a similarity score, which is a value indicating the degree of similarity between the complete picture of the attack by the attacker and the feature of the attacker.

Description

Reasoning device, reasoning method, and storage medium

This disclosure relates to hypothetical reasoning techniques.

Hypothetical inference is a method of deriving valid hypotheses from inference knowledge (rules) given by logical formulas and observed events. For example, in the field of cybersecurity, what-if reasoning can be applied when determining whether an observed event in a computer system is due to a cyberattack. For example, Patent Literature 1 discloses a technique for reflecting the temporal context of observations on hypothesis candidates generated by weighted hypothesis inference.

On the other hand, Patent Document 2 discloses a technique for calculating the degree of similarity between multiple suspicious activity graphs, which are structured to represent the activity details of targeted attacks and malware. In addition, Patent Literature 2 discloses a technique for associating an analysis result record of a suspicious activity graph with an expected attack source.

International publication WO2021/090497 JP 2016-206943 A

However, Patent Document 1 does not specifically disclose the perspective of performing inference processing using information related to attackers who carry out cyber attacks. Therefore, according to the technology disclosed in Patent Document 1, there is a problem that the estimation accuracy for estimating an attacker who carries out a cyber attack becomes low.

Further, according to the technology disclosed in Patent Document 2, for example, in a situation where it is difficult to obtain a suspicious activity graph due to reasons such as access to a network in which a suspicious activity detection device is installed, There is a problem that the estimation accuracy of the probable attack source associated with the record of the analysis result of the activity graph becomes low.

One purpose of this disclosure is to improve the accuracy of estimating attackers who carry out cyberattacks.

In one aspect of the present disclosure, an inference device includes:
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. an inference means for obtaining an overall picture of the attack by the attacker, in which the attack modus operandi is hierarchically abstracted in the case of
and a similarity obtaining means for obtaining a similarity, which is a value indicating how similar the overall image of the attack by the attacker and the features of the attacker are.

In another aspect of the present disclosure, an inference apparatus includes:
an inference means for obtaining an overall picture of an attack, in which the modus operandi of an attack corresponding to the observation log is hierarchically abstracted by performing inference processing based on an observation log in which information related to a cyber attack is recorded;
and a similarity obtaining means for obtaining a similarity, which is a value indicating how similar the overall image of the attack and the features of the attacker inferred from past attacks are.

In yet another aspect of the disclosure, an inference method includes:
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. Obtaining an overall picture of the attack by the attacker, in which the attack modus operandi in the case of is hierarchically abstracted,
A degree of similarity, which is a value indicating how similar an overview of attacks by the attacker and the features of the attacker are, is obtained.

In yet another aspect of the disclosure, an inference method includes:
By performing inference processing based on observation logs in which information related to cyberattacks is recorded, obtaining an overall picture of attacks in which the modus operandi of attacks corresponding to the observation logs are hierarchically abstracted,
A degree of similarity, which is a value indicating the degree of similarity between the overall image of the attack and the features of the attacker inferred from past attack cases, is acquired.

In yet another aspect of the present disclosure, the recording medium comprises
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. Obtaining an overall picture of the attack by the attacker, in which the attack modus operandi in the case of is hierarchically abstracted,
A program is recorded that causes a computer to execute a process of obtaining a similarity, which is a value indicating how similar an overview of the attack by the attacker and the characteristics of the attacker are.

In yet another aspect of the present disclosure, the recording medium comprises
By performing inference processing based on observation logs in which information related to cyberattacks is recorded, obtaining an overall picture of attacks in which the modus operandi of attacks corresponding to the observation logs are hierarchically abstracted,
A program is recorded that causes a computer to execute a process of obtaining a similarity, which is a value indicating the degree of similarity between the overall picture of the attack and the features of the attackers inferred from past attack incidents.

According to the present disclosure, it is possible to improve the estimation accuracy related to the estimation of attackers who carry out cyber attacks.

2 is a block diagram showing the hardware configuration of the inference device according to the first embodiment; FIG. 2 is a diagram showing the functional configuration of an inference device according to the first embodiment; FIG. 4 is a diagram showing an example of an observation log used for inference processing of the inference apparatus according to the first embodiment; FIG. FIG. 4 is a diagram showing an example of aggressor feature information used for inference processing of the inference device according to the first embodiment; FIG. 4 is a diagram showing an example of aggressor feature information used for inference processing of the inference device according to the first embodiment; FIG. 4 is a diagram for explaining an example of an inference result obtained by the inference processing of the inference apparatus according to the first embodiment; FIG. 4 is a diagram for explaining an example of an inference result obtained by the inference processing of the inference apparatus according to the first embodiment; FIG. 4 is a diagram showing an example of aggressor estimation information generated by the inference device according to the first embodiment; FIG. 4 is a diagram for explaining an example of a display screen displayed according to processing of the inference apparatus according to the first embodiment; 4 is a flowchart for explaining processing performed by the inference device according to the first embodiment; 8 is a flowchart for explaining processing performed by the inference device according to the modification of the first embodiment; FIG. 5 is a block diagram showing the functional configuration of an inference device according to the second embodiment; 9 is a flowchart for explaining processing performed by the inference device according to the second embodiment; FIG. 11 is a block diagram showing the functional configuration of an inference device according to the third embodiment; 10 is a flowchart for explaining processing performed by the inference device according to the third embodiment;

Preferred embodiments of the present disclosure will be described below with reference to the drawings.

<First Embodiment>
[Hardware configuration]
FIG. 1 is a block diagram showing the hardware configuration of the inference device 100. As shown in FIG. As illustrated, the inference apparatus 100 includes an interface (IF) 11 , a processor 12 , a memory 13 , a recording medium 14 , a database (DB) 15 , a display section 16 and an input section 17 .

The IF 11 performs data input/output with external devices. Specifically, observation information used for inference is input through the IF 11 . Attacker estimation information (described later) and the like obtained by the inference device 100 are output to an external device through the IF 11 .

The processor 12 is a computer such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit), and controls the entire inference apparatus 100 by executing a program prepared in advance. Specifically, the processor 12 executes processing such as inference processing, which will be described later.

The memory 13 is composed of ROM (Read Only Memory), RAM (Random Access Memory), and the like. Memory 13 is also used as a working memory during execution of various processes by processor 12 .

The recording medium 14 is a non-volatile, non-temporary recording medium such as a disk-shaped recording medium or semiconductor memory, and is configured to be detachable from the inference device 100 . The recording medium 14 records various programs executed by the processor 12 . When the inference apparatus 100 executes various processes, the programs recorded in the recording medium 14 are loaded into the memory 13 and executed by the processor 12 .

The database 15 stores observation information and the like input through the IF 11. In addition, the database 15 stores inference results and the like obtained by the processing of the aggressor estimation unit 22, which will be described later. The database 15 also stores aggressor feature information, which will be described later.

The display unit 16 is configured by a display device such as a liquid crystal monitor, for example. In addition, the display unit 16 displays information such as inference results as necessary.

The input unit 17 is composed of an input device such as a keyboard, mouse, touch panel, etc., for example.

[Function configuration]
FIG. 2 is a diagram showing the functional configuration of the inference device according to the first embodiment.

The inference device 100 has an input reception unit 21, an aggressor estimation unit 22, and an information output unit 23.

The input receiving unit 21 receives input of observation logs in which events and the like actually observed in response to attacks on the network domain NDX are recorded.

Specifically, in the observation log described above, for example, the content of an event that actually occurred in one of the computers belonging to the network domain NDX and the occurrence time (time stamp) of the event are listed in chronological order. Contains sorted information. That is, the above-mentioned observation log records information related to cyberattacks.

The aggressor estimation unit 22 has an inference unit 31, a similarity acquisition unit 32, and an aggressor database 33. In addition, the attacker estimation unit 22 provides information on an attacker who is estimated to have attacked the network domain NDX based on the observation log (hereinafter referred to as observation log LX) whose input is received by the input reception unit 21. A process is performed to obtain the attacker estimation information. The aggressor estimation unit 22 also outputs the aggressor estimation information obtained by the above-described processing to the information output unit 23 .

The inference unit 31 has an inference engine 31a and an inference rule storage unit 31b. Also, the inference unit 31 performs inference processing based on the observation log LX and aggressor feature information AFJ (described later) stored in the aggressor database 33 . The inference unit 31 also outputs the inference result obtained by the inference processing to the similarity acquisition unit 32 .

The inference engine 31a performs inference processing using the inference rules stored in the inference rule storage unit 31b, whereby the attacker indicated by the attacker feature information AFJ attacks the network domain NDX. Assuming that information corresponding to the observation log LX is actually left, an overall picture of the attack on the network domain NDX is estimated. Also, the inference engine 31a performs inference processing for each of a plurality of attackers indicated by the attacker feature information AFJ. That is, the inference result obtained by the inference processing of this embodiment includes observation logs LX when each of a plurality of attackers indicated by the attacker feature information AFJ independently attacks the network domain NDX. It contains an overview of multiple attacks against the network domain NDX, assuming that information was left behind.

The inference rule storage unit 31b stores inference rules used for the inference processing of the inference engine 31a.

Note that the inference engine 31a of the present embodiment reflects the temporal context of observations on hypothesis candidates generated by weighted hypothesis inference, as disclosed in International Publication WO2021/090497. Technology shall be used.

In addition, in the inference rule storage unit 31b of the present embodiment, an inference rule that incorporates the viewpoint of TTP (Tactics, Techniques and Procedures) for the rules (inference knowledge) disclosed in International Publication WO2021/090497. It is assumed that rules are stored.

TTP is a framework that hierarchically abstracts (models) cyberattack methods used by attackers. Specifically, for example, in the TTP framework (https://attack.mitre.org/) disclosed by MITER, the methods of cyber attacks by attackers are "Tactics", "Techniques", and It is represented by the three levels of abstraction of "Procedures". In the following description, an example in which the TTP framework disclosed by MITRE is incorporated in the inference rules will be described. In the following description, the TTP framework disclosed by MITRE is simply abbreviated as TTP.

Based on the inference result obtained by the inference unit 31 and the aggressor feature information AFJ, the similarity acquisition unit 32 determines whether one attacker among the plurality of attackers indicated by the aggressor feature information AFJ is in the network. Similarity, which is a value that indicates the degree of similarity between the overall image of an attack when it is assumed that an attack has been made on the domain NDX and the characteristics of the attacker indicated by the attacker characteristics information AFJ. Get degrees. Further, the similarity acquisition unit 32 acquires a plurality of similarities corresponding to each of the plurality of aggressors indicated by the aggressor feature information AFJ, and obtains aggressor estimation information in which the acquired plurality of similarities are arranged in descending order. and outputs the generated aggressor estimation information to the information output unit 23 .

The aggressor database 33 stores aggressor feature information AFJ representing the features of each of a plurality of aggressors.

The aggressor feature information AFJZ, which represents the features of attacker Z, is information that abstracts the attack modus operandi based on TTP, inferred from the contents of public reports in past attacks believed to have been carried out by said attacker Z. It includes information that associates certain abstract information with an evaluation value that is a value obtained by evaluating the specificity of the attack modus operandi represented by the abstract information. That is, the aggressor feature information AFJ includes the same information as the above-described aggressor feature information AFJZ as information representing the features of each of a plurality of aggressors.

In this embodiment, as a public report when creating abstract information based on TTP, for example, https://content.secureworks.com/~/media/Files/JP/Reports/Secureworks-Bronze-Butler-Report .ashx?modified=20180419151034 etc. can be used.

The information output unit 23 generates a display screen for displaying the aggressor estimation information and the like output from the aggressor estimation unit 22, and outputs the generated display screen to the display device. That is, the information output unit 23 has a function as display screen generation means. Further, the information output unit 23 outputs data including aggressor estimation information output from the aggressor estimation unit 22 to an external device.

[Specific example of processing performed in inference device]
Here, a specific example of processing performed in the inference device 100 of this embodiment will be described. FIG. 3 is a diagram showing an example of an observation log used for inference processing of the inference apparatus according to the first embodiment.

(Input observation information)
The input receiving unit 21 receives an input of an observation log L1 as shown in FIG. 3 as an observation log actually observed in response to an attack on the network domain ND1.

In the observation log L1 of FIG. 3, the session hijacking from PC_123 to PC_456 occurred at time T11, the reservation of the task requiring administrator authority occurred at time T21 after time T11, and , that the creation of the large-scale compressed file occurred at time T31 later than time T21.

(inference processing)
The inference unit 31 performs inference processing based on the observation log L<b>1 and the aggressor feature information AFJ stored in the aggressor database 33 .

4 and 5 are diagrams showing an example of aggressor feature information used in the inference processing of the inference device according to the first embodiment.

The aggressor feature information AFJ includes, for example, aggressor feature information AFJA as shown in FIG. 4 and aggressor feature information AFJB as shown in FIG.

The attacker feature information AFJA includes abstract information and evaluation values representing the features of attacker A. Also, the aggressor feature information AFJB includes abstract information representing the aggressor B's features and an evaluation value.

"Lateral Movement" in the abstracted information of the attacker's characteristic information AFJA is the wording "We will perform cross-sectional infringement" included in the public report of the past attack that is believed to have been carried out by attacker A. It corresponds to an abstract representation of the attack method inferred from Also, the aforementioned "Lateral Movement" corresponds to "Tactic", which is set to the highest level of abstraction in TTP.

"Impact" in the abstracted information of the attacker's characteristic information AFJA is "attacks on the control of the core system" included in the public report in the past attack case believed to have been carried out by attacker A. It corresponds to an abstract representation of the attack method inferred from the wording of . Further, the aforementioned "Impact" corresponds to "Tactic" which is set to the highest abstraction level in TTP.

"File Deletion", one of the abstracted information of the attacker's characteristic information AFJA, is included in the public report of past attacks believed to have been carried out by attacker A. "After achieving the purpose, the trail will be deleted It corresponds to an abstract expression of the attack method inferred from the phrase "". Also, the aforementioned "File Deletion" corresponds to "Technique", which is set to the second highest level of abstraction in TTP.

The "Lateral Movement" in the abstracted information of the attacker's characteristic information AFJB is the "expanding infection to other terminals" included in the public report of past attacks believed to have been carried out by attacker B. It corresponds to an abstract representation of the attack method inferred from the wording of .

"Privilege Escalation" in the abstracted information of the attacker's characteristic information AFJB is included in a public report of a past attack that is believed to have been carried out by attacker B. It corresponds to an abstract expression of the attack method inferred from the phrase "". Also, the above-mentioned "Privilege Escalation" corresponds to "Tactic" which is set to the highest abstraction level in TTP.

"Data from Network Shared Drive ⇒ Data Compressed" in the abstracted information of the attacker characteristic information AFJB is the "Information collection and compression A file will be generated." In addition, the aforementioned "Data from Network Shared Drive" and "Data Compressed" correspond to "Technique", which is set to the second highest level of abstraction in TTP.

In the present embodiment, abstract information corresponding to the content of one public report includes one or more pieces of information corresponding to any one of "Tactics", "Techniques", and "Procedures". Just do it.

The evaluation values included in the attacker characteristic information AFJA and AFJB are values calculated using the following formula (1). In the following formula (1), EV represents an evaluation value, AGN represents the total number of attackers included in the attacker characteristic information AFJ, and ATN has the same abstract information in the attacker characteristic information AFJ. Let ln denote the number of attackers and ln denote the natural logarithm.

Specifically, for example, "Lateral Movement" is included in both the aggressor characteristic information AFJA and AFJB, so the evaluation value EV=0. Further, for example, "Impact" is included in the aggressor characteristic information AFJA but is not included in the aggressor characteristic information AFJB, so the evaluation value EV=ln(2).

6 and 7 are diagrams for explaining an example of the inference result obtained by the inference processing of the inference device according to the first embodiment.

The inference unit 31 performs inference processing based on the observation log L1 and the aggressor feature information AFJA. Assuming that the attack on the network domain ND1 is made by the attacker A, the inference result is, for example, , obtain an inference result HRA as shown in FIG. In addition, the inference unit 31 performs inference processing based on the observation log L1 and the attacker characteristic information AFJB, so that the inference result when it is assumed that the attack on the network domain ND1 is by the attacker B is , for example, an inference result HRB as shown in FIG. The inference unit 31 also outputs the inference results HRA and HRB obtained by the inference processing to the similarity acquisition unit 32 .

The inference result HRA is a hierarchical abstraction of the method of attacking the network domain ND1 when it is assumed that the attacker A leaves information corresponding to the observation log L1 when attacking the network domain ND1. Also, it corresponds to the overall image of the attack by the attacker A.

The inference result HRB hierarchically abstracts the method of attacking the network domain ND1 when it is assumed that the attacker A leaves information corresponding to the observation log L1 when attacking the network domain ND1. Also, it corresponds to the overall image of the attack by the attacker B.

The abstract information ("Tactics" and "Techniques") included in each of the inference results HRA and HRB is appropriately selected by the inference engine 31a. Also, the time of occurrence in each of the inference results HRA and HRB is set as the time corresponding to the time of occurrence in the observation log L1. Also, the logs in each of the inference results HRA and HRB correspond to "Procedures" set to the third highest (lowest) abstraction level in TTP. The abstract information and log shown in the column of time T22 in the inference result HRB in FIG. 7 correspond to the attack modus operandi added by the inference engine 31a as a hypothesis based on the observation log L1 and the aggressor characteristic information AFJB. Time T22 corresponds to time after time T21 and before time T31.

In the present embodiment, the inference engine 31a appropriately selects what kind of abstract information and log to add as a hypothesis. Also, in the present embodiment, the inference engine 31a appropriately selects where to add abstracted information and logs as hypotheses.

(Obtaining similarity)
Based on the inference result HRA obtained by the inference unit 31 and the aggressor characteristic information AFJA, the similarity acquisition unit 32 obtains the overall image of the attack by the attacker A and the attack indicated by the aggressor characteristic information AFJA. A similarity DSA, which is a value indicating the degree of similarity between the features of the person A, is acquired. Further, based on the inference result HRB obtained by the inference unit 31 and the aggressor characteristic information AFJB, the similarity acquisition unit 32 obtains the overall image of the attack by the aggressor B and the aggressor characteristic information AFJB. A similarity DSB, which is a value indicating how similar the features of the attacker B are, is obtained.

The similarities DSA and DSB can be obtained, for example, by performing cosine similarity calculations based on the idea of TF-IDF (Term Trequency-Inverse Document Frequency).

Here, a specific method of obtaining the similarity DSB will be described.

The similarity acquisition unit 32 compares the abstract information included in the attacker feature information AFJB and the abstract information included in the inference result HRB, thereby obtaining The presence or absence of the attack modus operandi included in the feature information AFJB is specified. Then, according to the process of the similarity acquisition unit 32, it is specified that "Lateral Movement", "Privilege Escalation", and "Data from Network Shared Drive ⇒ Data Compressed" appear in the inference result HRB. be.

The similarity acquisition unit 32 describes the evaluation values (0, ln(2), ln(2)) included in the aggressor feature information AFJB and the presence or absence of the specified appearance as 1 if it appears as described above. Further, by calculating the product of each element in (1, 1, 1) described as 0 if it does not appear, the calculation result (0, ln(2), ln(2)) is obtained.

The similarity acquisition unit 32 uses the aforementioned evaluation values (0, ln(2), ln(2)) and the aforementioned calculation results (0, ln(2), ln(2)) as vectors to obtain cosine A similarity DSB is obtained by calculating the similarity.

The cosine similarity can be calculated by the following formula (2). Therefore, for example, in the following formula, the evaluation value (0, ln(2), ln(2)) is applied to vector X, and the calculation result (0, ln(2), ln(2)) is applied to vector Y. 1 can be obtained as the similarity DSB value corresponding to cos(X, Y) by

The method of obtaining the degree of similarity DSB described above is also applied to obtaining the degree of similarity DSA in substantially the same way.

Note that in the present embodiment, the similarity is set to 0 when cos(X, Y) has no solution because the value of the denominator of the above formula (2) is 0. Therefore, the similarity acquisition unit 32 of this embodiment acquires 0 as the value of the similarity DSA.

(Display, etc. of presumed attacker information)
The similarity acquisition unit 32 generates aggressor estimation information ASJ in which the similarity DSA corresponding to the aggressor A and the similarity DSB corresponding to the aggressor B are arranged in descending order, and obtains the generated aggressor estimation information ASJ is output to the information output unit 23 . FIG. 8 is a diagram showing an example of aggressor estimation information generated by the inference device according to the first embodiment.

The attacker estimation information ASJ is generated, for example, as information shown in FIG. Specifically, the attacker estimation information ASJ is a ranking table in which (names corresponding to) the attackers included in the attacker feature information AFJ are arranged in descending order of probability of having attacked the network domain ND1. is generated as

The information output unit 23 generates a display screen for displaying the ranking table included in the aggressor estimation information ASJ output from the aggressor estimation unit 22, and outputs the generated display screen to the display device. That is, when a plurality of degrees of similarity corresponding to each of a plurality of attackers is acquired, the information output unit 23 generates a display screen for displaying a ranking in which the degrees of similarity are arranged in descending order.

According to the present embodiment, for example, when a plurality of past attack incidents are stored in the aggressor database 33, the similarity acquisition unit 32, when generating the aggressor estimation information ASJ, It is also possible to acquire an attack incident similar to the characteristics of the attacker A or B from among the attack incidents, and add the acquired attack incident to the aforementioned ranking table. That is, according to the present embodiment, the similarity acquisition unit 32 may acquire other past attack incidents similar to the characteristics of the attacker A or the attacker B. FIG.

According to the present embodiment, the similarity acquisition unit 32 obtains a probability value representing the degree of possibility (reliability) that the attacker A actually attacked the network domain ND1 based on the similarities DSA and DSB. PSA and probability value PSB representing the degree of possibility (reliability) that attacker B actually attacked network domain ND1 may be calculated. Specifically, the similarity acquisition unit 32 applies a softmax function to the similarities DSA and DSB, for example, so that the probability values PSA and PSB total 100%. You may make it calculate. Further, according to the present embodiment, the similarity acquisition unit 32 may add the probability values PSA and PSB to the above-described ranking table when generating the aggressor estimation information ASJ.

According to this embodiment, for example, even if the attacker characteristic information AFJ includes an IoC (Indicator of Compromise) such as a hash value of a specific malware and an IP address used in a cyberattack, good. The IoC may be rephrased as trace information indicating traces of an attack performed by an attacker.

According to this embodiment, the inference unit 31 may perform inference processing using the aggressor characteristic information AFJ and IoC. Further, according to the present embodiment, the similarity acquisition unit 32 may add the IoC to the aforementioned ranking table when generating the aggressor estimation information ASJ.

According to the present embodiment, the information output unit 23 displays the display screen JDG as shown in FIG. may be generated. In other words, the information output unit 23 may generate a display screen for displaying an overview of the attack by the attacker. FIG. 9 is a diagram for explaining an example of a display screen displayed according to processing of the inference device according to the first embodiment.

In the display area on the left side of the display screen JDG in FIG. 9, a selection field SLR for selecting either attacker A or attacker B, and a selection frame SLW indicating that attacker B is selected. , probability value PSB (73%), and probability value PSA (27%) are displayed. In addition, in the selection column SLR, the attacker B corresponding to the probability value PSB is displayed at the top, and the attacker A corresponding to the probability value PSA is displayed below the attacker B. In addition, in the display area on the right side of the display screen JDG in FIG. 9, an overview ATB of the attack by the attacker B selected in the selection field SLR is displayed.

According to the overview ATB, the elements belonging to "Tactic" in FIG. 7 are connected by arrows oriented according to the order of the time of occurrence in the same figure. Further, according to the overview ATB, "Log", "Technique", and "Tactic" at one occurrence time in FIG. 7 are connected by arrows oriented according to this order. Further, according to the overview ATB, the element added as a hypothesis (the element corresponding to the column of time T22 in FIG. 7) of the inference result HRB is displayed in a manner different from other elements. Further, according to the overview ATB, attack methods common to both the attacker feature information AFJB and the inference result HRB are highlighted.

In addition, the whole picture ATB, as long as it is possible to identify the element added as a hypothesis in the inference result HRB, and the attack method common to both the attacker characteristic information AFJB and the inference result HRB, It may be displayed in color. Also, the overview ATB may include information indicating the IoC.

(processing flow)
FIG. 10 is a flowchart for explaining processing performed by the inference device according to the first embodiment.

First, the input receiving unit 21 receives an input of the observation log L1 in which the events actually observed in response to the attack on the network domain ND1 are recorded (step S11).

Next, the inference unit 31 performs inference processing based on the observation log L1 input in step S11 and the aggressor characteristic information AFJA and AFJB stored in the aggressor database 33, thereby obtaining an inference result HRA and HRB are acquired (step S12).

Next, the similarity acquisition unit 32 acquires the similarity DSA based on the inference result HRA obtained in step S12 and the aggressor characteristic information AFJA (step S13). Further, the similarity acquisition unit 32 acquires a similarity DSB based on the inference result HRB obtained in step S12 and the aggressor characteristic information AFJB (step S13).

The similarity acquisition unit 32 generates aggressor estimation information ASJ in which the similarities DSA and DSB obtained in step S13 are arranged in descending order, and outputs the generated aggressor estimation information ASJ to the information output unit 23 (step S14). Then, the ranking table included in the attacker estimation information ASJ is displayed on the display device in accordance with such processing of the similarity acquisition unit 32 .

As described above, according to the present embodiment, inference processing is performed based on observation logs that record information related to cyberattacks and the characteristics of attackers inferred from past attack incidents. It is possible to estimate the degree of similarity between the overall image of the attack obtained by the inference processing and the characteristics of the attacker. Further, as described above, according to the present embodiment, even if a series of attack processes includes an attack method that does not leave a clear trace, such as creating a large-scale compressed file. Even if there is, it is possible to obtain useful information for estimating the attacker who actually performed the series of attack processes. Therefore, according to this embodiment, it is possible to improve the estimation accuracy related to the estimation of the attacker who carries out the cyber attack.

(Modification)
Modifications of the above embodiment will be described below. In the following description, for the sake of simplification, a detailed description of portions to which the above-described processing and the like can be applied will be omitted as appropriate. FIG. 11 is a flowchart for explaining processing performed by the inference device according to the modification of the first embodiment.

The inference unit 31 of the present embodiment may perform inference processing for estimating the overall image ATX of the attack on the network domain ND1 based on the observation log L1 received by the input reception unit 21. Further, the similarity acquisition unit 32 of the present embodiment may acquire the similarities DSA and DSB using the overall image ATX and the aggressor characteristic information AFJA and AFJB. A specific example of such processing will be described below.

First, the input receiving unit 21 receives an input of the observation log L1 in which the events actually observed in response to the attack on the network domain ND1 are recorded (step S21).

Next, the inference unit 31 performs inference processing based on the observation log L1 input in step S21, thereby obtaining an overall image ATX of the attack in which the modus operandi of the attack corresponding to the observation log L1 is hierarchically abstracted. (step S22).

Here, the inference result HRX is obtained as close to the observation log L1 as possible without including hypotheses. Therefore, in step S22, an inference result HRX similar to the inference result HRA in FIG. 6 is obtained.

Next, based on the inference result HRX obtained in step S22 and the aggressor characteristic information AFJA, the similarity acquisition unit 32 determines the overall image ATX and the aggressor A indicated by the aggressor characteristic information AFJA. A similarity DSC, which is a value indicating how similar the features are, is obtained (step S23). Further, based on the inference result HRX obtained in step S22 and the aggressor characteristic information AFJB, the similarity acquisition unit 32 determines the overall image ATX and the characteristics of the aggressor B indicated by the aggressor characteristic information AFJB. , acquires a similarity DSD, which is a value indicating the degree of similarity between , and (step S23).

In step S23, the degree of similarity can be obtained using a method similar to the method described above. Therefore, in step S23, 0 is acquired as the value of the similarity DSC, and 1/√2 is acquired as the value of the similarity DSD.

The similarity acquisition unit 32 generates aggressor estimation information ASK in which the similarities DSC and DSD obtained in step S23 are arranged in descending order, and outputs the generated aggressor estimation information ASK to the information output unit 23 (step S24). Then, the ranking table included in the aggressor estimation information ASK is displayed on the display device in accordance with such processing of the similarity acquisition unit 32 . Note that the aggressor estimation information ASK is generated as the same as the aggressor estimation information ASJ illustrated in FIG.

As described above, according to this modification, inference processing is performed based on observation logs that record information related to cyberattacks, and the overall picture of attacks obtained by the inference processing and past attacks It is possible to estimate how similar the characteristics of the attackers inferred from the incident are. Also, as described above, according to this modified example, even if a series of attack processes includes an attack method that does not leave a clear trace, such as creating a large-scale compressed file. Even if there is, it is possible to obtain useful information for estimating the attacker who actually performed the series of attack processes. Therefore, according to this modified example, it is possible to improve the estimation accuracy related to the estimation of the attacker who carries out the cyber attack.

<Second embodiment>
FIG. 12 is a block diagram showing the functional configuration of an inference device according to the second embodiment.

The inference device 100A according to this embodiment has the same hardware configuration as the inference device 100. The inference device 100A also has inference means 41 and similarity acquisition means 42 .

FIG. 13 is a flowchart for explaining the processing performed by the inference device according to the second embodiment.

The inference means 41 performs inference processing based on an observation log in which information related to a cyberattack is recorded and the characteristics of an attacker inferred from past attack cases, so that the attacker corresponds to the observation log. An overall picture of the attack by the attacker is obtained, in which the method of the attack is hierarchically abstracted assuming that the information is left (step S41).

The similarity acquisition means 42 acquires a similarity, which is a value indicating how similar the overall image of the attack by the attacker and the characteristics of the attacker are (step S42).

According to this embodiment, it is possible to improve the estimation accuracy related to estimation of attackers who carry out cyber attacks.

<Third Embodiment>
FIG. 14 is a block diagram showing the functional configuration of an inference device according to the third embodiment.

The inference device 100B according to this embodiment has the same hardware configuration as the inference device 100. The inference device 100B also has an inference means 51 and a similarity acquisition means 52 .

FIG. 15 is a flowchart for explaining the processing performed by the inference device according to the third embodiment.

The inference means 51 performs inference processing based on an observation log in which information related to a cyberattack is recorded, thereby obtaining an overall image of the attack in which the modus operandi of the attack corresponding to the observation log is hierarchically abstracted. (Step S51).

The similarity acquisition means 52 acquires a similarity, which is a value that indicates the degree of similarity between the overall attack and the characteristics of the attackers inferred from past attack cases (step S52).

Some or all of the above embodiments can also be described as the following additional remarks, but are not limited to the following.

(Appendix 1)
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. an inference means for obtaining an overall picture of the attack by the attacker, in which the attack modus operandi is hierarchically abstracted in the case of
A similarity acquisition means for acquiring a similarity, which is a value indicating how similar the overall image of the attack by the attacker and the characteristics of the attacker are,
A reasoning device with

(Appendix 2)
an inference means for obtaining an overall picture of an attack, in which the modus operandi of an attack corresponding to the observation log is hierarchically abstracted by performing inference processing based on an observation log in which information related to a cyber attack is recorded;
a similarity acquisition means for acquiring a similarity, which is a value indicating the degree of similarity between the overall image of the attack and the characteristics of the attacker inferred from past attack incidents;
A reasoning device with

(Appendix 3)
3. The reasoning device according to

supplementary note

1 or 2, wherein the similarity obtaining means further obtains other past attack incidents similar to the characteristics of the attacker.

(Appendix 4)
3. The reasoning device according to

Supplementary Note

1 or 2, wherein the similarity obtaining means calculates a probability value representing a degree of possibility that the attacker has actually attacked based on the similarity.

(Appendix 5)
3. The reasoning device according to

appendix

1 or 2, wherein the characteristics of the attacker include trace information indicating traces of attacks performed by the attacker.

(Appendix 6)
Supplementary note 1 or further comprising display screen generation means for generating a display screen for displaying a ranking in which the degrees of similarity are arranged in descending order when a plurality of degrees of similarity corresponding to each of the plurality of attackers is obtained; 2 reasoning device.

(Appendix 7)
1. The reasoning apparatus according to Supplementary Note 1, further comprising display screen generation means for generating a display screen for displaying an overall image of the attack by the attacker.

(Appendix 8)
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. Obtaining an overall picture of the attack by the attacker, in which the attack modus operandi in the case of is hierarchically abstracted,
An inference method for obtaining a similarity, which is a value indicating how similar an overview of an attack by the attacker and the characteristics of the attacker are.

(Appendix 9)
By performing inference processing based on observation logs in which information related to cyberattacks is recorded, obtaining an overall picture of attacks in which the modus operandi of attacks corresponding to the observation logs are hierarchically abstracted,
An inference method for acquiring a degree of similarity, which is a value indicating the degree of similarity between the overall picture of the attack and the features of the attacker inferred from past attack incidents.

(Appendix 10)
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. Obtaining an overall picture of the attack by the attacker, in which the attack modus operandi in the case of is hierarchically abstracted,
A recording medium recording a program for causing a computer to execute a process of obtaining a similarity, which is a value indicating how similar an overview of an attack by the attacker and the characteristics of the attacker are.

(Appendix 11)
By performing inference processing based on observation logs in which information related to cyberattacks is recorded, obtaining an overall picture of attacks in which the modus operandi of attacks corresponding to the observation logs are hierarchically abstracted,
A recording medium recording a program that causes a computer to execute a process of obtaining a similarity, which is a value indicating how similar the overall image of the attack and the characteristics of the attacker inferred from past attacks are.

Although the present disclosure has been described above with reference to the embodiments and examples, the present disclosure is not limited to the above embodiments and examples. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure.

12 processor 21 input receiving unit 22 aggressor estimation unit 23 information output unit 31 inference unit 32 similarity acquisition unit 33 aggressor database

Claims

Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. an inference means for obtaining an overall picture of the attack by the attacker, in which the attack modus operandi is hierarchically abstracted in the case of
A similarity acquisition means for acquiring a similarity, which is a value indicating how similar the overall image of the attack by the attacker and the characteristics of the attacker are,
A reasoning device with
an inference means for obtaining an overall picture of an attack, in which the modus operandi of an attack corresponding to the observation log is hierarchically abstracted by performing inference processing based on an observation log in which information related to a cyber attack is recorded;
a similarity acquisition means for acquiring a similarity, which is a value indicating the degree of similarity between the overall image of the attack and the characteristics of the attacker inferred from past attack incidents;
A reasoning device with
The inference device according to claim 1 or 2, wherein the similarity acquisition means further acquires other past attack incidents similar to the characteristics of the attacker.
The inference device according to claim 1 or 2, wherein the similarity acquisition means calculates a probability value representing the degree of possibility that the attacker actually made an attack based on the similarity.
The reasoning device according to claim 1 or 2, wherein the characteristics of the attacker include trace information indicating traces of attacks made by the attacker.
2. A display screen generating means for generating a display screen for displaying a ranking in which the degrees of similarity are arranged in descending order when a plurality of degrees of similarity corresponding to each of the plurality of attackers are obtained. 3. Or the inference device according to 2.
The reasoning apparatus according to claim 1, further comprising display screen generation means for generating a display screen for displaying the overall image of the attack by the attacker.
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. Obtaining an overall picture of the attack by the attacker, in which the attack modus operandi in the case of is hierarchically abstracted,
An inference method for obtaining a similarity, which is a value indicating how similar an overview of an attack by the attacker and the characteristics of the attacker are.
By performing inference processing based on observation logs in which information related to cyberattacks is recorded, obtaining an overall picture of attacks in which the modus operandi of attacks corresponding to the observation logs are hierarchically abstracted,
An inference method for acquiring a degree of similarity, which is a value indicating the degree of similarity between the overall picture of the attack and the features of the attacker inferred from past attack incidents.
Assuming that the attacker left information corresponding to the observation log by performing inference processing based on the observation log in which information related to cyberattacks was recorded and the characteristics of the attacker inferred from past attack incidents. Obtaining an overall picture of the attack by the attacker, in which the attack modus operandi in the case of is hierarchically abstracted,
A recording medium recording a program for causing a computer to execute a process of obtaining a similarity, which is a value indicating how similar an overview of an attack by the attacker and the characteristics of the attacker are.
By performing inference processing based on observation logs in which information related to cyberattacks is recorded, obtaining an overall picture of attacks in which the modus operandi of attacks corresponding to the observation logs are hierarchically abstracted,
A recording medium recording a program that causes a computer to execute a process of obtaining a similarity, which is a value indicating how similar the overall image of the attack and the characteristics of the attacker inferred from past attacks are.