WO2024079972A1

WO2024079972A1 - Cyber attack countermeasure assistance system, cyber attack countermeasure assistance method, and cyber attack countermeasure assistance program

Info

Publication number: WO2024079972A1
Application number: PCT/JP2023/029177
Authority: WO
Inventors: 大輔辻; 英光納谷; 浩通遠藤; 悠田村; イェンスデーンホフ; 倫宏重本
Original assignee: 株式会社日立製作所
Priority date: 2022-10-11
Filing date: 2023-08-09
Publication date: 2024-04-18
Also published as: JP2024056559A

Abstract

In the present invention, an appropriate countermeasure against a cyber attack can be designed. A cyber attack countermeasure assistance system 1000 for designing a countermeasure against a cyber attack on a prescribed object system comprises: a storage unit 120 for storing one or more attacker profiles 122 which include an objective of attack and an attack technique of an attacker who carries out a cyber attack, and one or more defender profiles 123 which include an objective of defense and a defense technique of a defender who carries out a defense against a cyber attack; and a countermeasure design unit 111 for designing a countermeasure against respective combinations between the attacker profiles 122 and the defender profiles 123, by using a system model 121 for reproducing the state of the object system and outputting an index value of one or more indexes which indicate performance of the object system and corresponding to the state of the object system.

Description

Cyber attack response support system, cyber attack response support method, and cyber attack response support program

The present invention relates to technology that helps respond to cyber attacks in systems that include information devices.

For example, computer systems in the industrial field (industrial control systems) are composed of highly reliable information devices specialized for specific control processes, including PLCs (Programmable Logic Controllers) and HMIs (Human Machine Interfaces). Industrial control systems play an important role in monitoring and controlling social infrastructure such as electricity, railways, water, and gas, as well as production facilities such as factories and plants. For this reason, it is important for industrial control systems to continue to operate stably (availability) even when abnormal situations occur.

In the past, industrial control systems were generally operated in an environment isolated from the outside world. However, in recent years, with the advancement of IoT (Internet of Things) technology, there have been an increasing number of cases where systems are connected to external networks such as the Internet. While connecting to external networks has improved productivity and convenience, it has also significantly increased the risk of cyber attacks. Since industrial control systems have a significant impact on society when they stop operating, they can become the target of Advanced Persistent Threat (APT) attacks, which are highly advanced attacks that are clearly targeted and carried out continuously. It is essential to implement sufficient security measures to minimize damage, but APT attacks often involve zero-day attacks, making it difficult to completely eliminate the risk of attacks occurring. Therefore, in order to reduce security risks, it is also important to establish an organizational structure that can quickly take measures to minimize the impact on the system even if an attack occurs.

In a general information system, an effective way to improve an organization's response capabilities is to deploy both an attacker group, consisting of experts who imitate attackers and launch attacks, and a defender group, consisting of experts (including the organization's security personnel) who thwart attacks, and to improve the defender group's decision-making and response capabilities through practical exercises involving both groups. It is recommended that the attacker group repeat practical exercises, imitating attacker profiles consisting of multiple attack objectives and attack methods, based on actual APT attack cases. The defender group can also change its defender profile, consisting of defensive objectives and defensive methods, depending on the situation, and repeat training under different conditions. In the cybersecurity field, the attacker group is called the red team and the defender group is called the blue team, and strengthening the organizational structure for responding to cyber attacks through joint practical exercises by both teams is sometimes called purple teaming.

However, unlike general information systems, availability is considered important in industrial control systems, so practical training that may affect availability is often not permitted to be performed on the actual system. In addition, industrial control systems require not only advanced security knowledge, but also the devising of countermeasures that take into account special system operations where availability is important, so there is a shortage of experts. For these reasons, defender groups lack training, which can lead to delays in decision-making and response when a cyber attack occurs, which can ultimately lead to the spread of damage.

For example, Patent Document 1 discloses a technology that, when a cyber attack is detected, presents the most appropriate countermeasure from among multiple predefined countermeasure templates, taking into account the impact of the countermeasure on the system's business.

JP 2018-137500 A

By using the technology disclosed in Patent Document 1, when a cyber attack is detected, it is possible to automate support for decision-making and response measures from the perspective of a defender group when a cyber attack occurs. However, since the response is from the defender's perspective, it is not necessarily an appropriate response, and it is not possible to present countermeasures that anticipate the actions of an attacker.

The present invention was developed in consideration of the above circumstances, and its purpose is to provide technology that makes it possible to design appropriate countermeasures against cyber attacks.

In order to achieve the above object, one aspect of the cyber attack response support system is a cyber attack response support system that designs countermeasures against cyber attacks on a specified target system, and includes a storage unit that stores one or more attacker profiles including the attack objectives and attack methods of an attacker who carries out a cyber attack, and one or more defender profiles including the defense objectives and defense methods of a defender who defends against the cyber attack, and a countermeasure design unit that reproduces the state of the target system and designs countermeasures for each combination of the attacker profile and the defender profile using a system model that reproduces the state of the target system and outputs index values of one or more indexes that indicate the performance of the target system corresponding to the state of the target system.

The present invention makes it possible to design appropriate countermeasures against cyber attacks.

FIG. 1 is a functional block diagram of a cyber-attack response support system according to the first embodiment. FIG. 2 is a diagram illustrating a system model according to the first embodiment. FIG. 3 is a diagram illustrating a time series transition of production volume according to the first embodiment. FIG. 4 is a diagram showing the configuration of an attacker profile according to the first embodiment. FIG. 5 is a diagram showing the configuration of a defender profile according to the first embodiment. FIG. 6 is a flowchart of a countermeasure design process according to the first embodiment. FIG. 7 is a diagram showing a system configuration of a system model that reflects anomaly detection information according to the first embodiment. FIG. 8 is a diagram for explaining prediction of an attacker's behavior with respect to the system model according to the first embodiment. FIG. 9 is a diagram illustrating a prediction of a defender's behavior with respect to a system model according to the first embodiment. FIG. 10 is a configuration diagram of a list of countermeasures according to the first embodiment. FIG. 11 is a configuration diagram of statistical information of countermeasures according to the first embodiment. FIG. 12 is a configuration diagram of information indicating the relationship between the observed attacker behavior and the match with the attacker profile according to the first embodiment. FIG. 13 is a functional block diagram of a cyber-attack response support system according to the second embodiment. FIG. 14 is a diagram showing the configuration of an output table of countermeasures according to the second embodiment. FIG. 15 is a functional block diagram of a cyber-attack response support system according to the third embodiment. FIG. 16 is a diagram illustrating a defender model according to the third embodiment. FIG. 17 is a flowchart of the defender model generation process according to the third embodiment.

The embodiments will be described with reference to the drawings. Note that the embodiments described below do not limit the invention as claimed, and not all of the elements and combinations thereof described in the embodiments are necessarily essential to the solution of the invention.

First Embodiment
FIG. 1 is a functional block diagram of a cyber-attack response support system according to the first embodiment.

The cyber-attack response support system 1000 includes a cyber-attack response support device 10, an anomaly detection system 11, an input/output device 12, and an industrial control system 13.

The cyber-attack response support device 10 is configured, for example, as a computer equipped with a processor, memory, storage device, etc., and has a processing unit 110 and a storage unit 120.

The processing unit 110 is a functional unit that is realized by the processor executing a program (cyber-attack response support program) deployed in memory. The processing unit 110 includes a countermeasure design unit 111, a countermeasure selection unit 112 as an example of a reception unit and display unit, and a countermeasure execution unit 113.

The memory unit 120 is composed of a storage device that stores data. The storage device is, for example, a memory such as a RAM (Random Access Memory), a HDD (Hard Disk Drive), or an SSD (Solid State Drive). The memory unit 120 may be constructed using an external storage medium such as an HDD or SSD that is independent of the cyber attack response support device 10. The memory unit 120 stores a system model 121, one or more attacker profiles 122, and one or more defender profiles 123.

The anomaly detection system 11 is a system that detects anomalies in the industrial control system 13 (target system) and is composed of a Network-based Intrusion Detection System (NIDS), which detects signs of attack by monitoring network communications in real time, and a Host-based Intrusion Detection System (HIDS), which detects signs of attack using software running within a computer. When the anomaly detection system 11 detects an anomaly in the target system, it notifies the countermeasure design unit 111 of the cyber attack response support device 10 of anomaly detection information including the location of the anomaly, the content of the anomaly, etc.

The input/output device 12 is a device that allows the user to interactively input and output data to the cyber-attack response support device 10, and is composed of a keyboard, mouse, display, etc.

The industrial control system 13 includes a plurality of information devices 130, a robot (not shown) controlled by the information devices 130, etc. The plurality of information devices 130 includes computer devices such as PLCs and HMIs, and network devices such as switches and firewalls that connect and disconnect the network between the computer devices.

Next, the processing unit 110 and memory unit 120 will be described in detail.

When the countermeasure design unit 111 receives anomaly detection information of the target system transmitted from the anomaly detection system 11, it starts its operation, reads the system model 121, the attacker profile 122, and the defender profile 123 from the storage unit 120, and executes a process of designing countermeasures in the industrial control system 13. The countermeasure selection unit 112 displays information on the designed countermeasures (countermeasure information) on the input/output device 12, and accepts designation of the countermeasure to be applied from the user via the input/output device 12. The countermeasure execution unit 113 performs a process of applying the countermeasure accepted by the countermeasure selection unit 112 to the industrial control system 13 and executing it.

The system model 121 is a model that includes configuration information of information devices in the target system and can reproduce the target system by being executed by the processing unit 110. The system model 121 also has a calculation function that quantifies the performance of the target system with one or more types of indexes depending on the state of the information devices. Here, the configuration information includes, for example, the hardware, software, vulnerability information, logical configuration, physical configuration, and dependency information between information devices for the information devices to operate normally, of the information devices. The configuration information also has attributes for expressing the state of the information devices, and it is possible to reflect anomaly detection information detected by the anomaly detection system 11 in the information devices.

Next, we will explain the calculation function of the system model 121.

FIG. 2 is a diagram illustrating the system model according to the first embodiment.

When status information 21 of information equipment 130 is input, system model 121 (strictly speaking, processing unit 110 using system model 121) outputs performance 23 of the target system quantified by one or more types of indexes. For example, status information 21 indicates that information equipment with identification name PLC1 is in normal operation, information equipment with identification name PLC2 is in DoS (Denial of Service) state, and information equipment with identification name HMI is in a state where the equipment operation mode has been changed. In this case, system model 121 outputs, for example, an index representing the performance of the target system and its value, such as production volume of 50%, confidentiality protection rate of 20%, and safety risk avoidance rate of 80%. Here, safety risk avoidance rate indicates the percentage of avoidance of a state that poses a risk in terms of safety.

The system model 121 may, for example, calculate the percentage of information devices in a normal operating state as the production volume. For example, if 100 information devices are operating in the target system and 50 of the information devices are in a normal operating state, the production volume may be calculated as 50%. In this example, the system model 121 calculates a unique production volume based only on the state information 21 of the information devices at a certain time, regardless of the time series transition of the state of the information devices. Note that this is not limited to this, and for example, the production volume may be calculated taking into account the history effect regarding the time series transition of the state of the information devices.

Next, an example of calculating the production volume taking into account the time series changes in the information device status information 21 is shown.

FIG. 3 is a diagram illustrating the time series transition of production volume according to the first embodiment. In FIG. 3, the horizontal axis represents time, and the vertical axis represents production volume. In the example of FIG. 3, all information devices are in a normal operating state from time 0 to t1, half of the information devices are in a normal operating state from time t1 to t2, and all information devices are in a normal operating state from time t2 onwards. In this example, the production volume is 100% until time t1, the production volume is a continuously decreasing value from time t1 to t2, and the production volume is a continuously recovering value from time t2 onwards.

Also, as a method for the system model 121 to calculate the confidentiality protection rate, for example, a confidentiality protection score may be set for each information device 130 in the industrial control system 13, and the ratio of the total scores of information devices 130 for which confidentiality protection is ensured to the total scores of all information devices 130 may be calculated.

Also, as a method for the system model 121 to calculate the safety risk avoidance rate, for example, a score for safety risk may be set for each information device 130 in the industrial control system 13, and the ratio of the total score of the information devices 130 for which safety risk has been avoided to the total score of all the information devices 130 may be calculated.

The calculations performed by the calculation function of the system model 121 are not limited to the above examples, and can be anything that can input information 21 about the status of the information device and output performance 23 of the target system quantified using one or more types of indices, and a different index may be used to calculate a certain index.

Next, we will explain the attacker profile 122.

FIG. 4 is a diagram showing the configuration of an attacker profile according to the first embodiment.

The attacker profile 122 is information that defines the type of attacker that is assumed. The attacker profile 122 is stored in the memory unit 120. In this embodiment, the memory unit 120 stores multiple (Ni) patterns of attacker profiles 122.

The attacker profile 122 includes an identifier, an identification name, an attack purpose, and an attack method. The attacker profile 122 may also include identification information of an APT group that has a similar attack purpose and attack method.

In the identifier, information capable of uniquely identifying the attacker profile 122 is defined. For example, an integer value from 1 to Ni is assigned as the identifier. In the identification name, a name that identifies the attacker profile 122 is defined. Note that in this embodiment, the identification name is also capable of uniquely identifying the attacker profile 122.

Attack methods are defined as specific attack methods that attackers can use, such as DoS and changing control parameters.

The attack objective defines the percentage (target value) of one or more indicators (attack objective indicators) that are considered important when carrying out an attack. This means that the attacker aims to maximize the change in this indicator. For example, in attacker profile 122-1, whose identification name is production volume-specialized, the attack objective is defined as "production volume (100%)", which means that the attack objective aims only to affect production volume. This means that the attacker of attacker profile 122-1 does not aim to affect other indicators such as confidentiality protection rate or safety risk avoidance rate.

In addition, in attacker profile 122-2, whose identification name is Balanced, the attack objective is defined as "production volume (30%), confidentiality protection rate (40%), safety risk avoidance rate (30%)," which means that the objective is to affect production volume, confidentiality protection rate, and safety risk avoidance rate in a ratio of 3:4:3.

As an example of how to calculate the impact on the target system, if the production volume changes as shown in Figure 3, the cumulative amount represented by the area of the shaded area in the figure can be used as the impact on the production volume, or the maximum instantaneous change can be used.

Hereafter, the influence of production volume, confidentiality protection rate, and safety risk aversion rate will be represented as X, Y, and Z. In the case of the production volume-specialized attacker profile 122-1, the objective is to maximize 1X, and in the case of the balanced attacker profile 122-2, the objective is to maximize 0.3X + 0.4Y + 0.3Z.

Next, we will explain the defender profile 123.

FIG. 5 is a diagram showing the configuration of a defender profile according to the first embodiment.

The defender profile 123 is information that defines the type of defender that is assumed. The defender profile 123 is stored in the memory unit 120. In this embodiment, the memory unit 120 stores multiple (Nj) patterns of defender profiles 123.

The defender profile 123 includes an identifier, an identification name, a defense purpose, and a defense method.

In the identifier, information capable of uniquely identifying the defender profile 123 is defined. For example, an integer value from 1 to Nj is assigned as the identifier. In the identification name, a name that identifies the defender profile 123 is defined. Note that in this embodiment, the identification name is also capable of uniquely identifying the defender profile 123.

Defensive methods define specific defensive techniques that defenders can use, such as changing the operating mode of a device or shutting down the device.

The defense objective defines the ratio (target value) of one or more indicators (defense objective indicators) that are considered important when implementing defense. This means that the defender aims to minimize the change in this indicator. For example, in the defender profile 123-1, whose identification name is safety risk avoidance rate specialization, the defense objective is defined as "safety risk avoidance rate (100%)", and therefore the defender of the defender profile 123-1 aims to minimize 1Z.

Furthermore, in the defender profile 123-2, whose identification name is confidentiality protection rate-oriented, the defense objectives are defined as "production volume (10%), confidentiality protection rate (70%), safety risk avoidance rate (20%)" and the objective is to minimize 0.1X + 0.7Y + 0.2Z.

Here, if the attack purpose of the attacker profile 122 and the defense purpose of the defender profile 123 are the same, it means that they are trying to achieve completely opposite goals. Note that it is not necessary for the attack purpose of the attacker profile 122 and the defense purpose of the defender profile 123 to be the same.

Next, the processing operation of the cyber attack response support device 10 will be explained.

FIG. 6 is a flowchart of the countermeasure design process according to the first embodiment.

The countermeasure design process is executed when the countermeasure design unit 111 of the cyber-attack countermeasure support device 10 receives anomaly detection information about the target system (industrial control system 13) from the anomaly detection system 11.

The countermeasure design unit 111 reads the system model 121 from the memory unit 120 and reflects the state corresponding to the received abnormality detection information in the system model 121 (S61).

Here, FIG. 7 is a diagram showing the system configuration of a system model that reflects anomaly detection information according to the first embodiment. In FIG. 7, the industrial control system 13 includes, as information devices 130, a monitoring terminal connected via a network, control server 1, control server 2, PLC 1, PLC 2, and an HMI, and the anomaly detection information includes information that an abnormal intrusion has been detected in the monitoring terminal.

In step S61, as shown in FIG. 7, in the system model 121, the attribute representing the state of the monitoring terminal is set to "unauthorized intrusion."

Returning to the explanation of FIG. 6, the countermeasure design unit 111 defines integer variables i and j and sets their values to 1 (S62).

Next, the countermeasure design unit 111 reads the attacker profile 122 with identifier i and the defender profile 123 with identifier j from the storage unit 120 (S63).

Then, the countermeasure design unit 111 uses the system model 121 to predict the behavior of the attacker based on the loaded attacker profile 122. Note that the attacker's behavior changes depending on the loaded attacker profile 122 because the attacker's purpose and attack method differ.

FIG. 8 is a diagram illustrating the prediction of an attacker's behavior against the system model according to the first embodiment.

For example, the attacker's behavior predicted from the production volume-specialized attacker profile 122-1 is that an attacker who has illegally intruded into a monitoring terminal will then attack the control server 1 using a "control parameter change" attack method, and finally attack the PLC 1 using a "DoS" attack method. The attack method is selected from the attack methods defined in the attacker profile 122-1. Furthermore, the attacker's behavior is derived so as to maximize the impact on the target system, represented by 1X, which corresponds to the purpose of the attack.

The attacker's behavior predicted from the balanced attacker profile 122-2 is, for example, that an attacker who has illegally invaded a monitoring terminal will then attack the control server 2 using the "control tag information collection" attack method, and finally attack the HMI using the "alarm setting change" attack method. This attacker's behavior is derived so as to maximize the impact on the target system, which is represented by 0.3X + 0.4Y + 0.3Z, which corresponds to the purpose of the attack.

Returning to the explanation of FIG. 6, the countermeasure design unit 111 uses the system model 121 to derive optimal countermeasures based on the attacker's behavior and the defender profile 123 (S63).

FIG. 9 is a diagram illustrating the prediction of the defender's behavior for the system model according to the first embodiment.

For example, the behavior of the defender predicted from the safety risk aversion rate specialized defender profile 123-1 is derived to be the optimal countermeasure for defending against PLC1 using the defense method of "stopping equipment." The defense method is selected from among the defense methods in the defender profile 123-1. In addition, the behavior of this defender is derived to minimize the impact on the target system represented by 1Z, which corresponds to the defense objective.

Furthermore, the behavior of the defender predicted from the confidentiality protection rate-oriented defender profile 123-2 is derived to be, for example, the optimal countermeasure for defending against the control server 1 using the defense method of "changing access control settings." This defender's behavior is derived to minimize the impact on the target system, which is represented by 0.1X + 0.7Y + 0.2Z, which corresponds to the defense objective.

Returning to the explanation of FIG. 6, the countermeasure design unit 111 compares the variable i with Ni and determines whether the variable i is less than Ni (S66). As a result, if the variable i is less than Ni (S66: Y), this means that countermeasures have not been derived for all attacker profiles 122 for one defender profile 123, so the countermeasure design unit 111 adds 1 to the variable i (S67) and proceeds to step S63.

On the other hand, if the variable i is not less than Ni (S66: N), this means that countermeasures have been derived for one defender profile 123, targeting all attacker profiles 122, so the countermeasure design unit 111 proceeds to step S68.

In step S68, the countermeasure design unit 111 compares the variable j with Nj and determines whether the variable j is less than Nj. As a result, if the variable j is less than Nj (S68: Y), this means that countermeasures have not been derived for all attacker profiles 122 for all defender profiles 123, so the countermeasure design unit 111 sets the variable i to 1, adds 1 to the variable j (S69), and proceeds to step S63.

On the other hand, if the variable j is not less than Nj (S68:N), this means that countermeasures have been derived for all attacker profiles 122 for all defender profiles 123, i.e., countermeasures of the Ni×Nj pattern have been derived, so the countermeasure design unit 111 outputs the derived countermeasures of the Ni×Nj pattern to the countermeasure selection unit 112 and ends the process.

This countermeasure design process allows a joint practical exercise between an attacker group and a defender group, which would be difficult to implement in an actual industrial control system 13, to be virtually carried out using the system model 121 with Ni x Nj patterns, and allows the deriving of countermeasures for each.

Next, the processing operation of the countermeasure selection unit 112 will be explained.

The countermeasure selection unit 112 displays on the input/output device 12 a list 100 (see FIG. 10) of countermeasures for the Ni×Nj pattern designed and output by the countermeasure design unit 111, and accepts from the user a selection of the countermeasure to be actually applied to the industrial control system 13. The user can compare the countermeasures by referring to the list displayed on the input/output device 12 connected to the countermeasure selection unit 112, and select the optimal countermeasure.

FIG. 10 is a diagram showing a list of countermeasures according to the first embodiment.

List 100 is a table that displays countermeasures for Ni×Nj patterns, and includes entries corresponding to each countermeasure for the Ni×Nj patterns. The entries in list 100 include fields for countermeasure 101, defender profile 102, attacker profile 103, and performance 104.

In countermeasure 101, the countermeasure corresponding to the entry is displayed. In countermeasure 101, the content of the countermeasure is written before the symbol @, and the identification name of the information device 130 for which the countermeasure is to be taken is written after the symbol @.

The defender profile 102 displays information (e.g., an identification name) that can identify the defender profile 123 from which the countermeasure corresponding to the entry was derived. In this embodiment, when the defender profile 123 is pressed (clicked), details of the defender profile 123 are displayed as shown in FIG. 5.

The attacker profile 103 displays information (e.g., an identification name) that can identify the attacker profile 122 from which the countermeasure corresponding to the entry has been derived. In this embodiment, when the attacker profile 122 is pressed (clicked), details of the attacker profile 122 are displayed as shown in FIG. 4.

Performance 104 displays index values for one or more indicators that indicate performance. Performance 104 includes fields such as production volume 104A, confidentiality protection rate 104B, and safety risk avoidance rate 104C.

Production volume 104A displays the production volume when the countermeasure corresponding to the entry is implemented. Confidentiality protection rate 104B displays the confidentiality protection rate when the countermeasure corresponding to the entry is implemented. Safety risk avoidance rate 104C displays the safety risk avoidance rate when the countermeasure corresponding to the entry is implemented.

The user can select the countermeasure to be actually applied to the industrial control system 13 from the list 100 via the input/output device 12, taking into consideration the assumed type of attacker, management priority, impact on the target system, etc.

The correspondence between the countermeasure and the cost and speed required to apply the countermeasure may be stored in the storage unit 120, and the countermeasure selection unit 112 may display the cost and speed required to apply the countermeasure in the list 100 in association with the countermeasure.

In addition, since there may be overlapping countermeasures in the list 100, in this embodiment, the countermeasure selection unit 112 displays statistical information regarding the derived countermeasures.

FIG. 11 is a configuration diagram of statistical information on countermeasures in the first embodiment.

The statistical information is, for example, information regarding the percentage of overlap between each countermeasure among all countermeasures. In FIG. 11, the overlap rate of each countermeasure is represented by a pie chart. This statistical information makes it easy to identify countermeasures with a high overlap rate, i.e., countermeasures that are considered to be recommended.

When the user completes the selection of a countermeasure by the countermeasure selection unit 112, the countermeasure execution unit 113 controls the application of the countermeasure selected by the user to the information device 130. Specifically, the countermeasure execution unit 113 transmits a communication command to cause the information device 130 to execute the countermeasure.

In addition, after a countermeasure is selected, the countermeasure selection unit 112 may continuously observe the anomaly detection information received from the anomaly detection system 11 and display information on the degree of match between the actually observed attacker behavior and the attacker profile.

FIG. 12 is a diagram showing the structure of information indicating the relationship between observed attacker behavior and a match with an attacker profile in the first embodiment.

In Figure 12, statistical information is shown in the form of a bar graph that represents the degree of agreement between some of the actual attacker behavior (attack route, method, etc.) and the behavior estimated by each attacker profile. This statistical information makes it possible to understand which attacker profile is most effective for estimating each behavior.

Second Embodiment
Next, a cyber-attack response support system according to the second embodiment will be described.

FIG. 13 is a functional block diagram of the cyber-attack response support system according to the second embodiment. Note that in the cyber-attack response support system 1100 according to the second embodiment, components similar to those in the cyber-attack response support system 1000 according to the first embodiment are designated by the same reference numerals.

The cyber attack response support system 1100 includes a new impact reassessment unit 114 in the processing unit 110.

The impact re-evaluation unit 114 starts operation based on a request from the countermeasure selection unit 112, reads the system model 121 and the attacker profile 122 and defender profile 123 corresponding to the selected countermeasure from the storage unit 120, and performs processing to evaluate the performance of the industrial control system 13.

The countermeasure selection unit 112 can accept multiple countermeasures from the user. When multiple countermeasures are accepted, the countermeasure selection unit 112 requests the impact reassessment unit 114 to instruct it to evaluate the impact on the target system when multiple countermeasures are executed simultaneously, and displays the evaluation results from the impact reassessment unit 114 as an output table 1400 (see FIG. 14).

Next, the processing operation of the cyber attack response support system 1100 will be explained.

The processing operations up to outputting the list 100 of countermeasures for Ni×Nj patterns in the cyber-attack response support system 1100 are the same as those in the cyber-attack response support system 1000 of the first embodiment.

If multiple countermeasures are selected for the list 100, the countermeasure selection unit 112 requests the impact reassessment unit 114 to evaluate the impact on the target system when the selected countermeasures are executed simultaneously.

When the impact re-evaluation unit 114 receives a request from the countermeasure selection unit 112, it reads the system model 121 and the attacker profile 122 and defender profile 123 corresponding to the selected countermeasures from the storage unit 120, and updates the state of the information device 130 in the system model 121 to a state corresponding to the selected countermeasures. Next, the impact re-evaluation unit 114 uses the calculation function of the system model 121 to quantify the performance of the target system using one or more indicators, and returns the result to the countermeasure selection unit 112.

The countermeasure selection unit 112 creates an output table 1400 based on the results from the impact reevaluation unit 114, and displays the output table 1400 on the input/output device 12. The user can refer to this output table 1400 to determine whether or not it is acceptable to apply multiple countermeasures simultaneously.

FIG. 14 is a diagram showing the configuration of an output table for countermeasures according to the second embodiment.

Output table 1400 is a table that displays information about the impact when multiple selected countermeasures are executed simultaneously. Output table 1400 includes fields for countermeasure 1401, defender profile 1402, attacker profile 1403, and performance 1404.

The countermeasures 1401 displays multiple selected countermeasures. In the example of FIG. 14, the countermeasures are "Stop device @PLC1" and "Change device operation mode @HMI."

The defender profile 1402 displays information (e.g., an identification name) that can identify the defender profile 123 from which each countermeasure was derived.

The attacker profile 1403 displays information (e.g., an identification name) that can identify the attacker profile 122 from which each countermeasure was derived.

Performance 1404 displays index values for one or more indicators that indicate the performance of the target system when multiple countermeasures are implemented simultaneously. Performance 1404 includes fields such as production volume 1404A, confidentiality protection rate 1404B, and safety risk avoidance rate 1404C.

Production volume 1404A displays the production volume when multiple countermeasures are implemented. Confidentiality protection rate 1404B displays the confidentiality protection rate when multiple countermeasures are implemented. Safety risk avoidance rate 1404C displays the safety risk avoidance rate when multiple countermeasures are implemented.

The user can refer to the output table 1400 to determine whether or not to execute multiple countermeasures simultaneously. When the countermeasure selection unit 112 receives an instruction from the user to execute multiple countermeasures, it notifies the countermeasure execution unit 113 of this, and the countermeasure execution unit 113 controls the application of the notified multiple countermeasures to the information device 130.

Third Embodiment
Next, a cyber-attack response support system according to the third embodiment will be described.

FIG. 15 is a functional block diagram of a cyber-attack response support system according to the third embodiment. Note that in the cyber-attack response support system 1200 according to the third embodiment, components similar to those in the cyber-attack response support system 1000 according to the first embodiment are designated by the same reference numerals.

Compared to the cyber-attack response support system 1000, the cyber-attack response support system 1200 is equipped with a new defender model generation unit 115 in the processing unit 110, some of the processing operations of the countermeasure design unit 116 are changed, and a new defender model 124 is stored in the memory unit 120.

In the cyber attack response support system 1000 according to the first embodiment, when the anomaly detection system 11 detects an anomaly, it predicts the attacker's behavior based on the attacker profile, and then derives the defender's behavior, including the optimal countermeasure, based on the defender profile. However, in the cyber attack response support system 1200 according to the third embodiment, when the anomaly detection system 11 detects an anomaly in the target system, it derives the optimal countermeasure without taking the step of predicting the attacker's behavior.

The defender model generation unit 115 reads the system model 121, attacker profile 122, and defender profile 123, and generates a defender model 124 that can input a system model that reflects the anomaly detection information of the anomaly detection system 11 and output countermeasures. The process of generating the defender model 124 by the defender model generation unit 115 (defender model generation process: see Figure 17) is executed at a stage before the anomaly detection system 11 detects an anomaly. One possible method of generating the defender model 124 is to utilize multi-agent reinforcement learning. When utilizing multi-agent reinforcement learning, the defender model generation unit 115 learns the defender model 124, and the countermeasure design unit 111 executes the defender model.

FIG. 16 is a diagram explaining the defender model according to the third embodiment.

The defender model 124 has a calculation function that inputs a system model 1601 that reflects the anomaly detection information of the anomaly detection system 11, for example, a system model 1601 that is represented by the state of the information devices 130 that make up the target system, and outputs an optimal countermeasure 1603 for the state of the information devices that make up the target system.

Next, we will explain the defender model generation process that generates the defender model.

FIG. 17 is a flowchart of the defender model generation process according to the third embodiment. FIG. 17 shows the defender model generation process that generates a defender model using multi-agent reinforcement learning.

The defender model generation unit 115 sets variables i and j to 1 (S1701). Next, the defender model generation unit 115 reads the system model 121, the attacker profile 122 of identifier i, and the defender profile 123 of identifier j from the storage unit 120 (S1702).

Next, the defender model generation unit 115 learns optimal behavior by operating an agent simulating an attacker (attacker agent) and an agent simulating a defender (defender agent) in the system model 121 as an environment (S1703).

Here, the actions that the attacker agent can execute are defined by the attacking methods in the attacker profile 122, and the reward that the attacker agent receives is determined by the attack objective in the attacker profile 122. For example, the reward that the attacker agent receives is determined according to the amount of change in the indicator defined in the attack objective. For example, an attacker agent generated based on the attacker profile 122-2, whose identification name is balanced in FIG. 4, may receive a reward that increases with an increase in 0.3X + 0.4Y + 0.3Z.

Furthermore, the actions that the defender agent can execute are stipulated by the defense methods of the defender profile 123, and the reward that the defender agent receives is determined by the defense objectives of the defender profile 123. For example, the reward that the defender agent receives is determined according to the amount of change in the indicators defined in the defense objectives. For example, a defender agent generated based on the defender profile 123-2, whose identification name in FIG. 5 is confidentiality protection rate-oriented, may receive a reward that increases with a decrease in 0.1X + 0.7Y + 0.2Z.

Then, the defender model generation unit 115 stores the defender agent that has completed the multi-agent reinforcement learning and is capable of outputting optimal behavior according to the state of the information device in the system model 121 in the storage unit 120 as the defender model 124 (S1704).

Then, the defender model generation unit 115 compares the variable i with Ni and determines whether the variable i is greater than Ni (S1705). As a result, if the variable i is not greater than Ni (S1705: N), this means that a defender model has not been created by performing multi-agent reinforcement learning on all attacker profiles 122 for one defender profile 123, so the defender model generation unit 115 adds 1 to the variable i (S1706) and proceeds to step S1702.

On the other hand, if the variable i is greater than Ni (S1705: Y), this means that a defender model has been created by performing multi-agent reinforcement learning on all attacker profiles 122 for one defender profile 123, so the defender model generation unit 115 proceeds to step S1707.

In step S1707, the defender model generation unit 115 compares the variable j with Nj and determines whether the variable j is greater than Nj. If the result is that the variable j is not greater than Nj (S1707: N), this means that a defender model has not been created by performing multi-agent reinforcement learning on all attacker profiles 122 for all defender profiles 123, so the defender model generation unit 115 sets the variable i to 1 and adds 1 to the variable j (S1708), and proceeds to step S1702.

On the other hand, if the variable j is greater than Nj (S1707: Y), this means that a defender model has been created by performing multi-agent reinforcement learning on all attacker profiles 122 for all defender profiles 123, i.e., a defender model 124 of the Ni×Nj pattern has been derived, so the defender model generation unit 115 stores the derived defender model 124 of the Ni×Nj pattern in the memory unit 120 and terminates the process.

Next, we will explain the countermeasure design process performed by the cyber attack response support system 1200.

The countermeasure design process is executed by activating the countermeasure design unit 116 when the cyber-attack response support device 10 receives anomaly detection information about the target system (industrial control system 13) from the anomaly detection system 11.

The countermeasure design unit 116 reads the system model 121 and the defender model 124 from the storage unit 120, reflects the state corresponding to the received abnormality detection information in the system model 121, inputs the state of the information device in the system model 121 reflecting the abnormality detection information to each of the defender models 124 of the Ni×Nj pattern, calculates countermeasures of the Ni×Nj pattern using each defender model 124, and outputs the calculated countermeasures of the Ni×Nj pattern to the countermeasure selection unit 112. According to this countermeasure design process, a joint practical exercise between an attacker group and a defender group, which is difficult to implement in an actual industrial control system 13, can be virtually implemented using the system model 121 to derive each countermeasure. Note that the processes executed by the countermeasure selection unit 112 and the countermeasure execution unit 113 thereafter are similar to those of the cyber attack response support system 1000 according to the first embodiment.

According to the cyber attack response support system 1200 of this embodiment, after the anomaly detection system 11 detects an anomaly, there is no need to take the step of predicting the attacker's behavior, and countermeasures can be derived using the Ni x Nj pattern defender model 124 that has been generated in advance for each combination of the attacker profile and the defender profile. Therefore, when a cyber attack occurs, countermeasures can be quickly presented to the user.

The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention.

For example, in the above embodiment, an example is shown in which an industrial control system 13 is the target, but the present invention is not limited to this and can be applied to general information systems.

In addition, in the above embodiment, an example is shown in which the anomaly detection system 11 is provided outside the industrial control system 13, but the present invention is not limited to this, and the anomaly detection system 11 may be provided within the industrial control system 13.

Furthermore, in the above embodiment, some or all of the processing performed by the processor may be performed by a hardware circuit. Furthermore, the program in the above embodiment may be installed from a program source. The program source may be a program distribution server or a recording medium (e.g., a portable recording medium).

10...cyber attack response support device, 11...anomaly detection system, 12...input/output device, 13...industrial control system, 110...processing unit, 111, 116...countermeasure design unit, 112...countermeasure selection unit, 113...countermeasure execution unit, 114...impact reevaluation unit, 115...defender model generation unit 120...storage unit, 121...system model, 122...attacker profile, 123...defender profile, 124...defender model, 1000, 1100, 1200...cyber attack response support system

Claims

A cyber attack response support system that designs countermeasures against a cyber attack on a specified target system,
A storage unit that stores one or more attacker profiles including an attack purpose and an attack method of an attacker who conducts a cyber attack, and one or more defender profiles including a defense purpose and a defense method of a defender who defends against a cyber attack;
a countermeasure design unit that uses a system model that reproduces a state of the target system and outputs index values of one or more indexes that indicate the performance of the target system corresponding to the state of the target system to design a countermeasure for each combination of the attacker profile and the defender profile;
A cyber attack response support system equipped with
The cyber attack response support system of claim 1, wherein the countermeasure design unit, when receiving detection information of a cyber attack against the target system, reflects the detection information in the system model and designs the countermeasure.
The attack purpose of the attacker profile includes an attack purpose index, which is one or more indexes among the index values output by the system model, and a target value thereof;
The cyber attack response support system of claim 1, wherein the countermeasure design unit predicts the attacker's behavior that will maximize the impact on the attack purpose indicator, and uses the system model to determine the countermeasure for the predicted behavior.
The defense objective of the defender profile includes a defense objective indicator, which is one or more indicators among the indicator values output by the system model, and a target value thereof;
The cyber attack response support system of claim 1, wherein the countermeasure design unit predicts the behavior of a defender that minimizes the impact on the defense objective index, and uses the system model to determine the countermeasure for the predicted behavior.
The device further includes a display unit that displays countermeasure information, which is information about the designed countermeasure,
The countermeasure information is
The cyber attack response support system of claim 1, comprising information on the content of the countermeasure, the corresponding attacker profile and defender profile, and information on the performance of the target system when the countermeasure is executed.
a reception unit that receives a selection of a countermeasure to be applied to the target system from the countermeasure information;
a countermeasure execution unit that applies the received countermeasure to the target system;
The cyber attack response support system according to claim 5 .
The display unit is
The cyber-attack countermeasure support system according to claim 5, which displays statistical information regarding the countermeasures.
2. The cyber attack response support system of claim 1, wherein the system model is constructed based on the hardware, software, vulnerability information, logical configuration, physical configuration, and dependency information between information devices for the normal operation of the information devices of the target system.
The display unit is
The cyber attack response support system of claim 5, which displays statistical information regarding the match between actual attacker behavior and the attacker profile based on detection information of a cyber attack against the target system.
The reception unit is
Accepting a selection of a plurality of countermeasures to be applied to the target system from among the countermeasures designed by Fukusu;
The cyber attack response support system according to claim 6 , further comprising an impact re-evaluation unit that calculates information regarding performance of the target system when the received countermeasures are executed.
a defender model that receives detection information of a cyber attack against the target system as an input and outputs a countermeasure for each combination of the attacker profile and the defender profile;
The cyber attack response support system according to claim 1 , wherein the countermeasure design unit designs the countermeasure using the defender model.
The cyber attack response support system according to claim 11, further comprising a defender model generation unit that creates the defender model that outputs the countermeasure for each combination by learning the optimal behavior of an attacker agent that acts based on each of the attacker profiles and a defender agent that acts based on each of the defender profiles.
A cyber-attack response support method by a cyber-attack response support system that designs countermeasures against a cyber-attack on a predetermined target system,
storing one or more attacker profiles including an attack purpose and an attack method of an attacker who performs a cyber attack, and one or more defender profiles including a defense purpose and a defense method of a defender who performs defense against the cyber attack;
A cyber attack response support method that uses a system model that reproduces the state of the target system and outputs index values of one or more indicators that indicate the performance of the target system corresponding to the state of the target system, and designs countermeasures for each combination of the attacker profile and the defender profile.
A cyber-attack response support program for causing a computer to execute a countermeasure against a cyber-attack on a predetermined target system,
The computer,
A storage unit that stores one or more attacker profiles including an attack purpose and an attack method of an attacker who conducts a cyber attack, and one or more defender profiles including a defense purpose and a defense method of a defender who defends against a cyber attack;
A cyber attack response support program that functions as a countermeasure design unit that designs countermeasures for each combination of the attacker profile and the defender profile using a system model that reproduces the state of the target system and outputs index values of one or more indicators that indicate the performance of the target system corresponding to the state of the target system.