Patent Application
20210320942
The present invention relates to an estimation method, an estimation device, and an estimation program.
Responding to a crisis such as a cyber incident requires an advanced knowledge such as forensics, and there are many cases where a small-scale company does not know how to deal with such a crisis. Moreover, a cyber incident may often cause a great trouble in providing services and continuing business and appropriate and urgent determination by executives is required. However, there is few executives having advanced knowledge related to an information system and cyber attacks, the damage may extend as the determination is delayed.
Conventionally, as a preventive measure for a cyber incident, an attempt has been made to reduce vulnerability in advance and prepare operation rules by security design or the like and apply patches frequently using vulnerability information obtained from Japan vulnerability notes (JVN) and perform user education. However, since it is not possible to reduce the occurrence probability of a cyber incident to zero even when such a countermeasure is taken, a mechanism for assisting a countermeasure after the occurrence is required.
As a countermeasure taken after a cyber incident occurs, an evaluation method or the like for estimating the risk of secondary infection on the basis of path information on a network, for example, is known (for example, see Patent Literature 1).
[PTL 1] Japanese Patent Application Publication No. 2015-95159
However, the conventional method has a problem that at a time point when a small event (an observation event) likely to lead to a cyber incident occurs, it is not possible to detect which attack will occur at an early stage. For example, in the evaluation method of estimating the risk of secondary infection, analysis starts with receiving the type of attack and the designation of a terminal infected primarily, and it can be said that this is the stage in which a user or a system administrator is conscious of “a cyber incident having occurred already”. Therefore, in actual cases such as a targeted attack, there are often cases where the damage has extended and it is too late when the person concerned has noticed the attack.
In order to solve the problems and attain the object, an estimation method according to the present invention is an estimation method executed by an estimation device, including: a receiving step of receiving a device ID for identifying a device in a network and an observation event that has occurred in the device as an input; an estimation step of acquiring attribute information of a device corresponding to the device ID received in the receiving step from a device information storage unit and estimating a risk that the device in the network is subject to an attack on the basis of the acquired attribute information and the observation event received in the receiving step; and an output step of outputting an estimation result obtained in the estimation step.
An estimation device according to the present invention includes a receiving unit that receives a device ID for identifying a device in a network and an observation event that has occurred in the device as an input; an estimation unit that acquires attribute information of a device corresponding to the device ID received by the receiving unit from a device information storage unit and estimates a risk that the device in the network is subject to an attack on the basis of the acquired attribute information and the observation event received by the receiving unit; and an output unit that outputs an estimation result obtained by the estimation unit.
An estimation program according to the present invention causes a computer to execute: a receiving step of receiving a device ID for identifying a device in a network and an observation event that has occurred in the device as an input; an estimation step of acquiring attribute information of a device corresponding to the device ID received in the receiving step from a device information storage unit and estimating a risk that the device in the network is subject to an attack on the basis of the acquired attribute information and the observation event received in the receiving step; and an output step of outputting an estimation result obtained in the estimation step.
According to the present invention, an effect that it is possible to detect which attack will occur at an early stage at a time point when an observation event likely to lead to a cyber incident occurs.
Hereinafter, an embodiment of an estimation method, an estimation device, and an estimation program according to the present application will be described in detail with reference to the drawings. The estimation method, the estimation device, and the estimation program according to the present application are not limited to this embodiment.
[First embodiment] In the following embodiment, a configuration of an estimation device 10 according to the first embodiment and the flow of processing of the estimation device 10 will be described sequentially, and the effects of the first embodiment will be described finally.
[Configuration of estimation device] First, a configuration example of a system including the estimation device 10 of the present embodiment will be described with reference to
The estimation device 10 is a server device that estimates the risk that a device in an observation target network will be subject to attack and outputs the estimated attack risk to the user terminal 20. Specifically, the estimation device 10 receives a device ID for identifying a device in a network and an observation event occurred in the device from the user terminal 20 as an input. The estimation device 10 may register incident information which associates an incident ID with a pair of a device ID and an observation event therein in advance and may be able to designate a device ID and an observation event by receiving the input of an incident ID from the user terminal 20.
The estimation device 10 estimates the risk that a device in a network will be subject to attack on the basis of the observation event and the attribute information of the device corresponding to the device ID and outputs the estimated attack risk to the user terminal 20. That is, the estimation device 10 estimates which device is under which attack on the basis of input information indicating which observation event has occurred in a certain device and outputs the estimation result to the user terminal 20.
The user terminal 20 is a device such as a personal computer (PC) or a smartphone, and for example, is a device used by a user in an information system department of a company that provides a network service. After notifying of input information indicating which observation event has occurred in a certain device, the user terminal 20 sends a risk estimation request to the estimation device 10, receives the estimation result from the estimation device, and displays the estimation result. For example, the user terminal 20 displays the type of attack a device is likely to be subject to and the probability of being subject to the attack as the estimation result.
A configuration of the estimation device 10 will be described with reference to
The communication processing unit 11 controls communication related to various pieces of information. For example, the communication processing unit 11 receives a device ID for identifying a device in a network and an observation event occurred in the device from the user terminal 20 as the input information and transmits the type of attack the device is likely to be subject to and the probability of being subject to the attack to the user terminal 20 as the estimation result.
The storage unit 13 stores data and programs necessary for various kinds of processing of the control unit 12, and includes an incident information storage unit 13a, an attribute information storage unit 13b, a device information storage unit 13c, and an observation event information storage unit 13d as those closely and particularly related to the present invention. For example, the storage unit 13 is a semiconductor memory element such as a random access memory (RAM) or a flash memory or a storage device such as a hard disk or an optical disc.
The incident information storage unit 13a stores incident information that associates an incident ID with a pair of a device ID and an observation event. It is assumed that the incident ID and the pair of the device ID and the observation event are designated and registered by the user terminal 20.
For example, as illustrated in
The attribute information storage unit 13b stores attribute information in which attribute values of a device such as a device type, firmware, an OS, or an installed application are defined for each attribute type. For example, as illustrated in
The device information storage unit 13c stores device information indicating which attribute a device in an observation target network has. For example, as illustrated in
The observation event information storage unit 13d stores observation event information in which an observation event that is likely to occur when being subject to attack is defined for each piece of attribute information. Specifically, the observation event information storage unit 13d stores the type of attack that a device is likely to be subject to and the probability of being subject to the attack in correlation with an observation event occurred in a device. For example, as illustrated in
The control unit 12 has an internal memory for storing necessary data and programs that define various processing procedures and includes a receiving unit 12a, an estimation unit 12b, and an output unit 12c as those closely and particularly related to the present invention, with which various kinds of processing are executed. The control unit 12 is an electronic circuit such as a central processing unit (CPU) or a micro processing unit (MPU) or an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).
The receiving unit 12a receives a device ID for identifying a device in a network and an observation event occurred in the device from the user terminal 20 as an input. For example, the receiving unit 12a may register incident information which associates an incident ID with a pair of a device ID and an observation event therein in advance and may receive the input of an incident ID from the user terminal 20. In this case, the receiving unit 12a receives incident information that associates an incident ID with a pair of a device ID and an observation event from the user terminal 20 in which an incident input screen is displayed and stores the incident information in the incident information storage unit 13a. The receiving unit 12a receives the input of an incident ID included in a risk estimation request from the user terminal 20 in which a risk estimation screen is displayed and notifies the estimation unit 12b of the incident ID.
The estimation unit 12b acquires attribute information of a device corresponding to the device ID received by the receiving unit 12a from the device information storage unit 13c and estimates the risk that a device in a network is subject to attack on the basis of the acquired attribute information and the observation event received by the receiving unit 12a. For example, upon receiving the incident ID from the receiving unit 12a, the estimation unit 12b acquires the device ID and the observation event corresponding to the incident ID from the incident information storage unit 13a. The estimation unit 12b acquires the attribute information of the device corresponding to the acquired device ID from the device information storage unit 13c and acquires the type of attack and the probability of being subject to the attack corresponding to the attribute information acquired from the device information storage unit 13c and the observation event received by the receiving unit 12a from the observation event information storage unit 13d. The estimation unit 12b notifies the output unit 12c of the acquired attack type and the probability.
The output unit 12c outputs the attack risk which is the estimation result estimated by the estimation unit 12b. For example, the output unit 12c outputs the attack type and the probability of being subject to the attack acquired by the estimation unit 12b to the user terminal 20 as the risk estimation result.
Here, an example of a risk estimation process by the estimation device 10 according to the first embodiment will be described with reference to
Subsequently, the estimation device 10 retrieves records matching the device ID of “web server 1” from the device information storage unit 13c. As a result, the estimation device 10 acquires “device type” of “server” and “web server”, “OS type” of “Windows Server 2016”, and “middleware” of “apache ver.xxx” from the device information storage unit 13c as the attribute information (attribute type and attribute value) corresponding to the device ID of “web server 1” (see device information B in
The estimation device 10 acquires “attack type” and “probability” of the record of the observation event information A having the same attribute information (attribute type, attribute value) among the retrieved observation event information A and device information B. In the example of
As described above, the estimation device 10 manages the attribute information, the device information, and the observation event information. The attribute information is information in which information of a device such as a device type, firmware, an OS, or an installed application is defined for each device that forms a certain system or service. The device information is information indicating which attribute each device has. The observation event information is information in which an observation event that is likely to occur when being subject to attack is defined for a device or an attribute. The estimation device 10 retrieves observation event information having a matching observation event item and device attribute from the observation event information and the device information on the basis of input information indicating which observation event has occurred in a certain device and estimates which device is subject to which attack. In this way, in the estimation device 10, it is possible to predict the type of attack occurred and the probability on the basis of information observed on a system and find a cyber incident and take countermeasures at an early stage.
[Processing procedure of estimation device] Next, an example of the processing procedure of the estimation device 10 according to the first embodiment will be described with reference to
As illustrated in
The receiving unit 12a receives the input of the incident ID included in the risk estimation request from the user terminal 20 in which a risk estimation screen is displayed (step S103) and notifies the estimation unit 12b of the risk estimation request (step S104).
Subsequently, upon receiving the incident ID from the receiving unit 12a, the estimation unit 12b acquires a target device ID and an observation event corresponding to the incident ID from the incident information storage unit 13a (step S105). The estimation unit 12b acquires attribute information of the device corresponding to the acquired target device ID from the device information storage unit 13c (step S106).
After that, the estimation unit 12b acquires the attack type and the probability of being subject to the attack corresponding to the attribute information acquired from the device information storage unit 13c and the observation event received by the receiving unit 12a from the observation event information storage unit 13d (step S107). The estimation unit 12b performs risk estimation of summing the probabilities when there are a number of same attack types, for example (step S108).
The estimation unit 12b notifies the output unit 12 of the attack type and the probability as the risk estimation result (step S109). The output unit 12c outputs the attack type and the probability of being subject to the attack received from the estimation unit 12b to the user terminal 20 as a risk estimation result (step S110).
[Effects of first embodiment] The estimation device 10 according to the first embodiment is a server device that estimates the risk that a device in an observation target network will be subject to attack and outputs the estimated attack risk to the user terminal 20. Specifically, the estimation device 10 receives a device ID for identifying a device in a network and an observation event occurred in the device from the user terminal 20 as an input. The estimation device 10 estimates the risk that a device in a network will be subject to attack on the basis of the attribute information and the observation event of the device corresponding to the device ID and outputs the estimated attack risk to the user terminal 20. In this way, the estimation device 10 can detect which attack will occur at an early stage at a time point when an observation event which is likely to lead to a cyber incident occurs.
[Second embodiment] In the first embodiment, a case in which an attack type and the probability of being subject to the attack are acquired from the observation event information storage unit 13d, and the acquired attack type and the probability of being subject to the attack are output to the user terminal 20 as a risk estimation result has been described. However, there is no limitation thereto. For example, in order to cope with a case in which an attack to be estimated results in a successful attack after taking several steps with respect to an observation event item, the risk that a device in a network will be subject to attack may be estimated on the basis of the probability of state transition in a series of state transitions resulting in an attack.
Therefore, hereinafter, a case in which the estimation device 10 according to the second embodiment defines information in which a Bayesian network representing a series of state transition resulting in an attack is defined, estimates which device is subject to which attack by calculating a state probability and an inter-state transition probability, and outputs a state transition diagram and the calculated state probability as a risk estimation result will be described. Description of the configuration and processing similar to those of the communication system according to the first embodiment will be omitted.
An observation event storage unit 13d of the estimation device 10 according to the second embodiment stores a state transition probability in correlation with the attribute information and the observation event of a device. Specifically, the observation event storage unit 13d stores information in which a state of being subject to attack is defined with respect to a device or an attribute and each state of a process of resulting in the state from an observation event, a device or an attribute of the device, an attack type, and an observation event likely to occur with respect to each state, and transition information indicating to which state and with which probability the present state will transition when the observation event occurs.
Here, an example of the data stored in the observation event information storage unit 13d will be described with reference to
For example, as illustrated in
The observation event storage unit 13d stores “transition destination state name”, “transition destination state transition diagram name”, “transition probability calculation method”, and “observation event list” as the “transition destination list”. The “transition destination state name” indicates the name of a transition destination state. The “transition destination state transition diagram name” includes a transition destination state set when transitioning to another transition diagram. The “transition probability calculation method” indicates a method of calculating a probability of state transition to a transition destination. The “observation event list” includes information related to an observation event for calculating a transition probability. For example, in the example of
The observation event storage unit 13d stores “observation event item” indicating the content of an observation event, “observation event type” indicating the type (unexamined or examined item) of an observation event, “initial value” indicating ON/OFF in the initial state, and “probability” when checked-ON as the “observation event list”. For example, in the example of
Next, an example of a state transition diagram will be described with reference to
In the example of
Next, a method in which the estimation device 10 according to the second embodiment estimates the risk from input information will be described. The estimation unit 12b of the estimation device 10 according to the second embodiment retrieves a state corresponding to the attribute information acquired from the device information storage unit 13c and the observation event received by the receiving unit 12a from the observation event information storage unit 13d. Moreover, the estimation unit 12b calculates a probability of state transition from the retrieved state and estimates the risk that a device in a network is subject to attack on the basis of the state transition probability.
Specifically, the estimation unit 12b retrieves a state having a matching observation event item and device or a matching device attribute from the observation event information and the device information on the basis of the input information indicating which observation event has occurred in a certain device and calculates a state probability and an inter-state transition probability.
Here, a risk estimation process when information input by the estimation device 10 according to the second embodiment is not present will be described with reference to
Since the transition probability of “Route1” which is a route of transitioning from the state of “unauthorized access state from Internet” to the state of “unauthorized access to servlet container management screen” is “10%” in the case of unexamined (see (2) in
Moreover, since the transition probabilities of “Route1” which is a route of transitioning from the state of “unauthorized access to servlet container management screen” and the state of “unauthorized input to Web service of company A” to the state of “intrusion to AP server 1” are “30%” in the case of unexamined (see (4) in
Next, a risk estimation process when the information input by the estimation device 10 according to the second embodiment is present will be described with reference to
For example, it is assumed that the estimation device 10 receives the following four pieces of information as the input information.
Target device ID=AP server 1, Observation event item=access log to management screen of subject server from IP address on Internet
Target device ID=AP server 1, Observation event item=access to management screen permitted from the Internet at FW and AP server 1
Target device ID=AP server 1, Observation event item=unauthorized attack file uploaded to public folder of Web service of company A
Target device ID=AP server 1, Observation event item=unauthorized access log
The estimation device 10 retrieves a record matching the device ID of “AP server 1” from the device information storage unit 13c. As a result, as illustrated in
The estimation device 10 searches the observation event information storage unit 13d using “observation event item=access log to management screen of subject server from IP address on Internet” and acquires “unauthorized access from Internet” as the state of attribute information the same as the attribute information (attribute type, attribute value) of the input information among the retrieved records. Moreover, similarly, the estimation device 10 searches the observation event information storage unit 13d using “observation event item=access to management screen permitted from the Internet at FW and AP server 1” and acquires the state “unauthorized access from Internet” as the state of attribute information the same as the attribute information (attribute type, attribute value) of the input information among the retrieved records.
Moreover, the estimation device 10 searches the observation event information storage unit 13d using “observation event item=unauthorized attack file uploaded to public folder of Web service of company A” and acquires the state “unauthorized input to Web service of company A” as the state of attribute information the same as the attribute information (attribute type, attribute value) of the input information among the retrieved records. Furthermore, the estimation device 10 searches the observation event information storage unit 13d using “observation event item=unauthorized access log” and acquires the state “unauthorized access from Internet” as the state of attribute information the same as the attribute information (attribute type, attribute value) of the input information among the retrieved records.
Subsequently, as illustrated in
Since the transition probabilities of “Route1” which is a route of transitioning from the state “unauthorized access state from Internet” to the state “unauthorized access to servlet container management screen” are checked as “20%” and “30%”, respectively, and the calculation method is addition, the estimation device 10 adds “0.2” and “0.3” (see (2) in
Moreover, similarly, the estimation device 10 sets the transition probability of “Route2” which is a route of transitioning from the state “unauthorized access state from Internet” to the state “unauthorized input to Web service of company A” to “10%” in the case of unexamined (see (2) in
The estimation device 10 sets the transition probability of “Route1” which is a route of transitioning from the state “unauthorized access to servlet container management screen” to the state “intrusion to AP server 1” to “30%” since the transition probability is unexamined (see (4) in
The estimation device 10 calculates “1−(1−0.5×0.3)(1−1×0.5)=0.00575” and obtains the probability of “57.5%” of the state “intrusion to AP server 1” (see (5) in
As described above, the estimation device 10 according to the second embodiment retrieves a state having a matching observation event item and device or a matching device attribute from the observation event information and the device information on the basis of the input information indicating which observation event has occurred in a certain device and calculates a state probability and an inter-state transition probability to estimate which device is subject to which attack. The estimation device 10 can present the state transition diagram and the calculated state probability as a risk estimation result.
(System Configuration and the Like)
The components of the devices illustrated in the drawings are functionally conceptual and are not necessarily physically configured as illustrated in the drawings. In other words, the specific aspects of distribution and integration of the devices are not limited to those illustrated in the drawings. All or part of the components may be distributed or integrated functionally or physically in desired units depending on various kinds of loads and states of use, for example. All or desired part of the processing functions performed by the devices are provided by a CPU or a program analyzed and executed by the CPU or as hardware by wired logic.
All or part of the processes described as being automatically performed among the processes described in the present embodiment may be performed manually. Alternatively, all or part of the processes described as being manually performed may be performed automatically by a known method. In addition, the processing procedures, the control procedures, the specific names, and the information including various kinds of data and parameters described in the present specification and the drawings can be arbitrarily changed unless there is any special mention.
(Program)
A program that describes processing executed by the estimation device described in the embodiment in a computer-executable language may be created. For example, an estimation program that describes processing executed by the estimation device 10 according to the embodiment in a computer-executable language may be created. In this case, the same effects as those of the embodiment can be obtained when the computer executes the estimation program. Furthermore, the same effects as those of the embodiment may be realized when the estimation program is recorded on a computer-readable recording medium, and the estimation program recorded on the recording medium is read into and executed by the computer.
The memory 1010 includes a read only memory (ROM) 1011 and a random access memory (RAM) 1012 as illustrated in
Here, as illustrated in
Various types of data described in the embodiment are stored in the memory 1010 and the hard disk drive 1090, for example, as the program data. The CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 into the RAM 1012 as necessary and performs the above-described processing procedures.
The program module 1093 and the program data 1094 related to the estimation program are not limited to being stored in the hard disk drive 1090, and for example, may be stored in a removable storage medium and read by the CPU 1020 via the disk drive and the like. Alternatively, the program module 1093 and the program data 1094 related to the estimation program may be stored in other computers connected via a network (such as a local area network (LAN) or a wide area network (WAN)) and read by the CPU 1020 via the network interface 1070.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2018-166433 | Sep 2018 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/032393 | 8/20/2019 | WO | 00 |
