Patent Application
20230024824
The present disclosure relates to an analysis apparatus, an analysis method, and a non-transitory computer readable medium storing an analysis program.
In recent years, there has been a significant increase in cyberattacks that attack vulnerabilities in information systems, which increases threat to cybersecurity. Therefore, as the information systems including control systems and IoT (Internet of Things) continue to become more diverse and more complex, a major issue is how to address the ever-increasing vulnerabilities in the information systems.
As related techniques, for example, Patent Literatures 1 and 2 are known. Patent Literature 1 describes that in a security diagnostic system, intrusion routes to the information assets of a target system are searched for, and a list of vulnerabilities in the intrusion routes is displayed. Further, Patent Literature 2 describes that in a network vulnerability inspection apparatus, vulnerability test data of unknown vulnerabilities and previously-undiscovered security holes is automatically created, and a vulnerability test of the inspection target network equipment is conducted.
In the related techniques such as those described in Patent Literatures 1 and 2, in order to analyze vulnerabilities in an information system, intrusion routes are searched for and vulnerability tests are conducted. However, the related techniques are techniques for extracting vulnerabilities that are obviously present in the assets of the information system or vulnerabilities that are already-discovered, and thus there is a problem that it is difficult to grasp the vulnerabilities that may have an impact on the information system (vulnerabilities that are not yet confirmed of their existence but if discovered, may have an impact on the system).
The present disclosure has been made in view of the problem mentioned above, and an object of the present disclosure is to provide an analysis apparatus, an analysis method, and a non-transitory computer readable medium storing an analysis program, each of the apparatus, the method, and the program being adapted to grasp vulnerabilities that may have an impact on an information system.
An analysis apparatus according to the present disclosure includes:
setting means for setting virtual vulnerabilities in a plurality of nodes configuring an information system to be analyzed;
extraction means for extracting an attack route of the information system based on the set virtual vulnerabilities; and
discrimination means for discriminating vulnerabilities to be monitored based on the virtual vulnerabilities in the extracted attack route.
An analysis method according to the present disclosure includes:
setting virtual vulnerabilities in a plurality of nodes configuring an information system to be analyzed;
extracting an attack route of the information system based on the set virtual vulnerabilities; and
discriminating vulnerabilities to be monitored based on the virtual vulnerabilities in the extracted attack route.
A non-transitory computer readable medium according to the present disclosure stores an analysis program for causing a computer to execute the processing of:
setting virtual vulnerabilities in a plurality of nodes configuring an information system to be analyzed;
extracting an attack route of the information system based on the set virtual vulnerabilities; and
discriminating vulnerabilities to be monitored based on the virtual vulnerabilities in the extracted attack route.
According to the present disclosure, it is possible to provide an analysis apparatus, an analysis method, and a non-transitory computer readable medium storing an analysis program, each of the apparatus, the method, and the program being adapted to grasp vulnerabilities that may have an impact on an information system.
Hereinbelow, example embodiments will be described with reference to the example embodiments. In the drawings, the same structural elements are denoted by the same reference symbols and redundant explanations thereof are omitted where appropriate.
(Study Leading to Example Embodiments)
First, management of vulnerabilities in information systems are investigated.
As shown in
In the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101). Software and hardware included in the information system are acquired by referring to a detailed design document of the information system and obtaining system configuration information of the information system.
Next, vulnerability information of the information system is collected (S102). The vulnerability information of the acquired software and hardware is collected from alert information by IPA (Information-technology Promotion Agency), public databases of vulnerability information such as CVE (Common Vulnerabilities and Exposures) and NVD (National Vulnerability Database).
Next, it is determined whether or not the vulnerabilities need to be addressed (S103). Based on the collected vulnerability information, it is determined whether or not the vulnerabilities of the software and the hardware should be addressed in the information system.
When it is determined that a countermeasure is needed, detection and analysis (S104) of an attack exploiting the vulnerability are performed as a countermeasure against the vulnerability (S120). By referring to a log of the information system, it is confirmed whether there is any trace of the attack which exploited the corresponding vulnerability. Depending on a result of the detection of the attack exploiting the vulnerability and the details of the vulnerability, necessary countermeasures such as prevention (mitigation measure) (S105), containment/eradication/recovery (S106), and prevention (permanent measure) (S107) shall be taken. In the prevention (mitigation measure) (S105), filtering of IP (Internet Protocol) addresses and URLs (Uniform Resource Locators) is set in the information system. The containment/eradication/recovery (S106) involve incident handling. In the prevention (permanent measure) (S107), a patch is installed in the information system.
With such a management method, for example, when a new vulnerability is discovered, an impact on the information system is assessed, and the administrator determines whether or not the vulnerability needs to be addressed. Safety of information systems can be maintained by addressing newly discovered vulnerabilities.
However, since the vulnerabilities in the information system are continuing to increase year by year, the number of the vulnerabilities which the administrators need to check for are increasing, and it is getting more difficult to determine whether or not vulnerabilities need to be addressed. That is, in the related techniques, every time vulnerability is discovered, impact of the newly discovered vulnerability on the information system is determined, and so all the newly discovered vulnerabilities must be checked (monitored) for their impacts on the information system.
Therefore, in the following example embodiments, by grasping and monitoring only the vulnerabilities that may have an impact on the information system, it is possible to reduce the burden of vulnerability management.
(Outline of Example Embodiments)
The setting unit 11 sets virtual vulnerabilities in nodes constituting an information system. The extraction unit 12 extracts an attack route of the information system based on the virtual vulnerabilities set by the setting unit 11. For instance, the extraction unit 12 extracts, using an attack route generation technique (an attack graph generation technique), a potential attack route in the information system to which the virtual vulnerabilities are set.
The discrimination unit 13 discriminates the vulnerabilities to be monitored based on the virtual vulnerabilities in the node in the attack route extracted by the extraction unit 12. For example, the discrimination unit 13 grasps the list of vulnerabilities that appear in a section of the extracted attack route from the starting point of the attack to the end of the attack, and in the list of vulnerabilities that appear in a section of the extracted attack route, the vulnerabilities that are already-discovered/previously-undiscovered at the current stage are investigated, and the undiscovered vulnerabilities are considered to be vulnerabilities to be monitored.
As described above, potential attack routes are extracted based on the virtual vulnerabilities that are pseudo vulnerabilities and by discriminating the virtual vulnerabilities in the extracted attack routes, it is possible to grasp the vulnerabilities that could establish an attack route in the information system, that is, it is possible to grasp the vulnerabilities that could have an impact on the information system.
Hereinbelow, a first example embodiment will be described with reference to the drawings.
<Classification of Vulnerability Types>
First, in order to facilitate understanding of the present example embodiment, how the vulnerabilities (the vulnerability information) are handled in the present example embodiment will be described. In the present example embodiment, the vulnerabilities are classified into predetermined types that are arbitrary determined based on the content of the attack. While various vulnerabilities are already discovered for each software (product) and for content of each attack, the vulnerabilities can be classified into several types based on the “attack category” and the “impact of exploitation”. The “attack category” is a category such as remote attack/local attack and the like (an intrusion method). The “impact of exploitation” refers to an impact on the system when the vulnerabilities are exploited (the result of the attack).
As described above, by converting the vulnerabilities (the vulnerability information) into the vulnerability types, even when the vulnerabilities are different from one another, they can be handled as the same type. In the present example embodiment, as a way of analyzing the vulnerabilities, there is a method of discriminating the types of the vulnerabilities of the node in the attack route to thereby grasp the impact of the vulnerabilities on the information system. For example, when the types of the vulnerabilities that could be exploited in an attack can be discriminated, that is, when there is vulnerability of a type that could be attacked if discovered, such type of vulnerability is to be monitored.
<System Configuration>
As shown in
The system configuration information DB 200 is a database for storing, in advance, the system configuration information of the information system to be analyzed. The system configuration information includes hardware information, software information, network information, various setting information, and the like of node devices (terminals) constituting the information system.
The vulnerability information DB 300 is a database for storing the vulnerability information of already-discovered (disclosed) vulnerability. As shown in, for instance,
The risk visualizing apparatus 100 includes a virtual vulnerability setting unit 101, an analysis element setting unit 102, an attack route analysis unit 103, an attack route extraction unit 104, a vulnerability analysis unit 105, and a display unit 106. Note that other configuration may be adopted as long as the operations described later can be performed.
The virtual vulnerability setting unit 101 sets the virtual vulnerabilities in the nodes constituting the information system to be analyzed. The virtual vulnerabilities are vulnerability type of virtual (pseudo) vulnerabilities. The virtual vulnerabilities encompass vulnerabilities of all possible vulnerability types, that is, the virtual vulnerabilities include all of the prescribed vulnerability types into which the vulnerabilities are classified. By setting the above-described virtual vulnerabilities, it is possible to extract all potential attack routes.
In order to generate the attack graph, the analysis element setting unit 102 sets analysis elements such as an intrusion point (entry point) of the attack route in the information system and an attack target. For example, the analysis elements may be set in advance or may be set by a user operation or the like. The attack route analysis unit 103 analyzes the attack route (the attack path) based on the analysis elements such as the set intrusion point and attack target. The attack path extraction unit 104 generates the attack graph by using the attack graph generation technique (attack graph generation tool) based on the analysis result, and extracts all potential attack routes from the generated attack graph. The attack graph is a graph showing attack steps assumed for the information system to be analyzed is applied, and nodes passing through the attack steps in order from the intrusion point to the attack target are connected. The connection route of the nodes from the intrusion point to the attack target in the attack graph is the attack route.
The vulnerability analysis unit (the discrimination unit) 105 analyzes the virtual vulnerabilities in the extracted attack route and discriminates the vulnerabilities to be monitored. The vulnerability analysis unit 105 discriminates the vulnerability to be monitored based on whether the virtual vulnerability in the attack route is vulnerability that is already discovered or not. When the virtual vulnerability in the attack route is previously-undiscovered vulnerability, the vulnerability analysis unit 105 determines that monitoring is to be performed for such undiscovered virtual vulnerability.
The display unit (the output unit) 106 is a display apparatus that displays the analysis result and the like and displays the discriminated vulnerability to be monitored and the like using the GUI (Graphical User Interface) and the like. For example, the display unit 106 distinguishably displays the vulnerability to be monitored in the attack route and the other vulnerabilities in the attack route. The display unit 106 is a liquid crystal display, an organic EL display, or the like and may be an external device of the risk visualizing apparatus 100. Note that the monitoring targets and the like may be output not only by displaying but also by other methods (by e-mails, data transmission or the like).
<Operation of System>
The virtual vulnerability setting unit 101 sets the virtual vulnerabilities in every node in the information system 400. In this example, virtual vulnerabilities are set in the OA terminal 411, the log server 421, the maintenance server 422, the monitoring control server 423, the HMI 424, the IoT device 431, and the FA device 432. Note that when the virtual vulnerabilities are applicable, the virtual vulnerabilities may be set in the firewalls FW1 and FW2, repeaters such as the programmable logic controllers PLC1 and PLC2, and the like.
Next, the risk visualizing apparatus 100 analyzes the attack route (S202). The analysis element setting unit 102 sets analytical elements such as the intrusion point of the attack route and the target of attack, and the attack route analysis unit 103 analyzes the attack route based on the set analytical elements.
For example, the display unit 106 displays a display screen 501 like that shown in
The attack route analysis unit 103 may analyze the attack route from the set intrusion point and the attack target or may analyze the arbitrarily designated attack route. For example, as the analytical elements, as shown in
Next, the risk visualizing apparatus 100 extracts the attack route (S203). The attack route extraction unit 104 generates an attack graph using the attack graph generation technique based on the information that is set and analyzed and extracts all potential attack routes. That is, by inputting the system configuration information to which the virtual vulnerabilities are set to the attack graph generation technique, an attack graph showing an attack from the intrusion point to the attack target via the virtual vulnerabilities of the nodes is generated.
The attack route consists of attack paths between nodes. Each attack path has the path establishment conditions set for node-to-node attacks to be established. For example, the attack route r2 includes an attack path p1 between the internet 401 and the OA terminal 411, an attack path p2 between the OA terminal 411 and the log server 421, and an attack path p3 between the log server 421 and the monitoring control server 423. That is, when attack paths p1 to p3 subsequently receive attacks that meet the path establishment conditions, attack to the attack target succeeds along the attack route r2. As shown in
Next, the risk visualizing apparatus 100 analyzes the vulnerabilities (S204). The vulnerability analysis unit 105 analyzes the virtual vulnerabilities in the attack route extracted from the attack graph. The vulnerability analysis unit 105 refers to each attack path included in the attack route in the attack graph and grasps all virtual vulnerabilities (a list of vulnerabilities) in the attack route from the starting point of the attack to the end of the attack. All attack routes included in the attack graph may be analyzed or only the shortest route may be analyzed. By analyzing all attack routes, it is possible to comprehensively analyze potential attack routes. Further, since the shortest route has the highest risk of being attacked, by analyzing only the shortest route, it is possible to effectively analyze the vulnerabilities of high risk.
The risk visualizing apparatus 100 checks whether the virtual vulnerabilities are vulnerabilities that are already-discovered/previously-undiscovered (S205), and when the virtual vulnerability is vulnerability that is previously-undiscovered, such previously-undiscovered vulnerability (the vulnerability type) is to be monitored (S206). The vulnerability analysis unit 105 refers to the vulnerability information DB 300 that stores the already-discovered vulnerabilities and confirms whether each virtual vulnerability (the vulnerability type) that has been grasped in the attack route is the vulnerability that has been already discovered or not. For instance, the vulnerability information DB 300 stores the vulnerability information including the vulnerability type of the vulnerability that is already discovered (disclosed). The vulnerability type (the attack category and the impact of exploitation) of the virtual vulnerability and the vulnerability type of the already-discovered vulnerability are compared and whether the vulnerabilities match each other are checked for. When there is no applicable vulnerability present in the vulnerability information DB 300, that is, when the virtual vulnerability in the attack route is previously-undiscovered vulnerability, such previously-undiscovered virtual vulnerability (the vulnerability type) is determined as vulnerability that could establish an attack route and is to be monitored. Note that the already-discovered vulnerability may be included in the vulnerability to be monitored as necessary.
For example, as shown in
Next, the risk visualizing apparatus 100 displays the analysis result (S207). The display unit 106 displays the vulnerability (the vulnerability type) to be monitored in the information system 400 and the attack route which includes the vulnerability in an identifiable manner. Further, only potential attack routes may be displayed, or the vulnerabilities to be monitored in the potential attack routes may be displayed.
The system information display region 502a displays the system configuration analyzed by the information system 400, displays the set intrusion point and the attack target, and displays the extracted attack route from the intrusion point to the attack target. Among the attack routes, the attack paths which include already-discovered vulnerabilities (the attack paths that are already existing) and the attack paths which include previously-undiscovered vulnerabilities (the potential paths for which vulnerabilities that are exploitable are not discovered) are displayed distinguishably.
For instance, the attack path 521 between the internet 401 and the OA terminal 411 is an attack path which includes already-discovered vulnerabilities and is shown by a solid line (e.g. a red solid line). Further, since the attack paths 522 to 526 from the OA terminal 411 to the monitoring control server 423 and the HMI 424 are attack paths which include previously-undiscovered vulnerabilities (non-attack routes), they are shown by dashed lines (e.g. blue dashed lines).
Further, the attack steps (the procedure of attack) in the analyzed attack route are displayed. For example, in the attack step A1, it is displayed that there is a possibility of the OA terminal 411 being infected with an email virus, and in the attack step A2, it is displayed that that the log server 421 cannot be intruded owing to the firewall FW2.
The attack route information display region 502b displays detailed information (such as risks etc.) with respect to the attack route displayed in the system information display region 502a. Such display is performed in correspondence with the attack steps in the attack route displayed in the system information display region 502a. The risk due to the attack path which includes the already-discovered vulnerabilities and the risk due to the attack path which includes previously-undiscovered vulnerabilities are displayed distinguishably (by changing colors or the like). For instance, in the display of the attack step A1, it is explained that there is a risk of the OA terminal 411 being attacked. Further, in the display of the attack step A2, it is explained that there is no risk of the system being intruded further than the log server 421. In the attack step A2, a mark or the like indicating safety is displayed.
The reference information display region 502c displays the reference information with respect to the detailed information of the attack route displayed in the attack route information display region 502b. Display is performed in correspondence with the attack steps in the attack route in the similar manner as that performed in the attack route information display region 502b. For example, in the attack step A1, since the attack route includes already-discovered vulnerabilities, as the reference information, link information (information source) of a website whose vulnerabilities are made public and the like are displayed as the reference information.
The system information display region 503a displays the system configuration and the attack route of the analyzed information system 400 like in the display example shown in
Like in
The reference information display region 503c displays the reference information corresponding to the attack steps in the attack route displayed in the attack route information display region 503b like in the display example shown in
<Effect>
As described above, in the present example embodiments, virtual vulnerabilities including all vulnerability types are set in every node of the information system, potential attack route is extracted using the attack graph generation technique, and the virtual vulnerabilities in the potential attack route is grasped. Based on whether the virtual vulnerability is the already-discovered/previously-undiscovered virtual vulnerability, when new vulnerability is discovered, discrimination is performed as to the possibility of the attack route being established. By this configuration, there is no need to confirm the impact of all the vulnerabilities that are discovered on the information system, and it is possible to manage vulnerabilities of the information system by only confirming (monitoring) the vulnerabilities that are determined in the present example embodiment, whereby it is possible to reduce the burden of management work.
The analysis method according to the first example embodiment may be implemented on a periodic basis. Since the database of the vulnerability information is updated as needed to thereby add new vulnerabilities, it is desirable to analyze vulnerabilities using more recent information. For example, the previous analysis result is stored in the storage device and by repeating determination as to whether the virtual vulnerabilities are those that are already-discovered/previously-undiscovered on a periodic basis, it is possible to detect that the vulnerability included in the attack route is newly discovered vulnerability. That is, the risk visualizing apparatus 100 may include a notification unit (an output unit) that refers to the vulnerability information DB 300, detects whether or not vulnerability determined to be monitored is the newly discovered vulnerability, and issues a notification when the vulnerability is the newly discovered vulnerability.
Note that each of the configurations in the above-described example embodiments is constituted by hardware and/or software, and may be constituted by one piece of hardware or software, or may be constituted by a plurality of pieces of hardware or software. As shown in
These programs can be stored and provided to a computer using any type of non-transitory computer readable media. Non-transitory computer readable media include any type of tangible storage media. Examples of non-transitory computer readable media include magnetic storage media (e.g. floppy disks, magnetic tapes, hard disk drives, etc.), optical magnetic storage media (e.g. magneto-optical disks), CD-ROM (Read Only Memory), CD-R, CD-R/W, and semiconductor memories (such as mask ROM, PROM (programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (random access memory), etc.). The program may be provided to a computer using any type of transitory computer readable media. Examples of transitory computer readable media include electric signals, optical signals, and electromagnetic waves. Transitory computer readable media can provide the program to a computer via a wired communication line such as electric wires and optical fibers or a wireless communication line.
Note that the present disclosure is not limited to the above-described example embodiments, and can be appropriately changed without departing from the spirit of the present disclosure.
The present disclosure has been described with reference to the example embodiments. However, it should be noted that the present disclosure is not to be limited in any way by the example embodiments described above. The configuration and the details of the present disclosure can be modified in various ways that can be understood by one skilled in the art within the scope of present disclosure.
The whole or part of the example embodiments disclosed above can be described as, but not limited to, the following supplementary notes.
(Supplementary Note 1)
An analysis apparatus comprising:
setting means for setting virtual vulnerabilities in a plurality of nodes configuring an information system to be analyzed;
extraction means for extracting an attack route of the information system based on the set virtual vulnerabilities; and
discrimination means for discriminating vulnerabilities to be monitored based on the virtual vulnerabilities in the extracted attack route.
(Supplementary Note 2)
The analysis apparatus as described in Supplementary note 1, wherein the virtual vulnerabilities include vulnerability types into which the vulnerabilities are pseudo-classified.
(Supplementary Note 3)
The analysis apparatus as described in Supplementary note 2, wherein the virtual vulnerabilities include possible vulnerability types into which the vulnerabilities are classified.
(Supplementary Note 4)
The analysis apparatus as described in Supplementary note 3, wherein each of the vulnerability types includes a type of intrusion method or a type of result of attack.
(Supplementary Note 5)
The analysis apparatus as described in Supplementary note 4, wherein each of the virtual vulnerabilities is a combination of the type of intrusion method and the type of result of attack.
(Supplementary Note 6)
The analysis apparatus as described in Supplementary note 4 or 5, wherein the intrusion method includes a remote attack or a local attack.
(Supplementary Note 7)
The analysis apparatus as described in any one of Supplementary notes 4 to 6, wherein the result of attack includes arbitrary code execution, data access, data tampering, and DoS (Denial of Service).
(Supplementary Note 8)
The analysis apparatus as described in any of Supplementary notes 1 to 7, wherein the extraction means generates an attack graph based on the virtual vulnerabilities and extracts the attack route from the generated attack graph.
(Supplementary Note 9)
The analysis apparatus as described in Supplementary note 8, wherein the generated attack graph includes conditions for establishing an attack path between the plurality of nodes.
(Supplementary Note 10)
The analysis apparatus as described in Supplementary note 9, wherein the discrimination means grasps the virtual vulnerabilities in the attack path based on the conditions for establishing the attack path.
(Supplementary Note 11)
The analysis apparatus as described in Supplementary note 10, wherein the discrimination means grasps the virtual vulnerabilities in all attack routes that are included in the attack graph.
(Supplementary Note 12)
The analysis apparatus as described in Supplementary note 10, wherein the discrimination means grasps the virtual vulnerability in the shortest route among the attack routes included in the attack graph.
(Supplementary Note 13)
The analysis apparatus as described in any of Supplementary notes 1 to 12, wherein the discrimination means discriminates the vulnerability to be monitored based on whether the virtual vulnerability in the attack route is vulnerability that is already discovered or not.
(Supplementary Note 14)
The analysis apparatus as described in Supplementary note 13, wherein when the virtual vulnerability in the attack route is not vulnerability that is already-discovered vulnerability, the discrimination means determines that the vulnerability is vulnerability to be monitored.
(Supplementary Note 15)
The analysis apparatus as described in any of Supplementary notes 1 to 14, further comprising output means for outputting the discriminated vulnerability to be monitored.
(Supplementary Note 16)
The analysis apparatus as described in Supplementary note 15, wherein the output means distinguishably displays the vulnerability to be monitored and other vulnerabilities in the attack route.
(Supplementary Note 17) An analysis method comprising:
setting virtual vulnerabilities in a plurality of nodes configuring an information system to be analyzed;
extracting an attack route of the information system based on the set virtual vulnerabilities; and
discriminating vulnerabilities to be monitored based on the virtual vulnerabilities in the extracted attack route.
(Supplementary Note 18)
The analysis method as described in Supplementary note 17, wherein the virtual vulnerabilities include vulnerability types into which the vulnerabilities are pseudo-classified.
(Supplementary Note 19)
An analysis program for causing a computer to execute the processing of:
setting virtual vulnerabilities in a plurality of nodes configuring an information system to be analyzed;
extracting an attack route of the information system based on the set virtual vulnerabilities; and
discriminating vulnerabilities to be monitored based on the virtual vulnerabilities in the extracted attack route.
(Supplementary Note 20)
The analysis program as described in Supplementary note 19, wherein the virtual vulnerabilities include vulnerability types into which the vulnerabilities are pseudo-classified.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/050981 | 12/25/2019 | WO |
