Incident effect range estimation device, incident effect range estimation method, storage medium, and system
Provided is an incident effect range estimation device which estimates the range of the effect of an incident and shortens incident handling time. This incident effect range estimation device is provided with an incident origin log acquisition unit which acquires log information for the incident-originating device which is related to the occurrence of the incident, a communication destination log acquisition unit which acquires, on the basis of the log information for the incident-originating device, log information for a communication destination device which is the communication destination of the incident-originating device, and an effect range estimation unit which estimates the range of the effect of the incident on the basis of the communication destination device. The range of the effect of the incident can thereby be estimated automatically, and thus incident handling time can be shortened significantly.
1. An incident effect range estimation device comprising:
a processor; and
a memory having stored therein computer instruct ions, wherein the processor executes the instruct ions to:
acquire log information of an occurrence source device related to occurrence of an incident;
acquire, based on the log information of the occurrence source device, log information of a communication destination device being a communication destination of the occurrence source device;
acquire, based on the log information of a communication destination device acquired, log information of a next communication destination device being a next communication destination;
calculate, based on the log information acquired, a weight score related to communication for each communication destination device, the weight score calculated based on at least one of; a change point of the communication destination, a change point of a communication protocol, a change rate of a communication amount, and a change rate of a communication frequency;
recursively repeat acquisition of the log information of the next communication destination device until the weight score calculated for the next communication destination device becomes equal to or smaller than a threshold value; and
estimate an extent of influence of the incident, based on the log information of the communication destination device and the log information of the next communication destination device acquired.
2. The incident effect range estimation device according to claim 1 , wherein
in the acquiring log information of a communication destination device, repeating acquisition of log information of the next communication destination device a predetermined number of times.
3. The incident effect range estimation device according to claim 2 , wherein in the acquiring log information of an occurrence source device and in the acquiring log information of a communication destination device, acquiring log information according to a type of the incident.
4. The incident effect range estimation device according to claim 2 , wherein in the estimating, generating a graph in which the occurrence source device and the communication destination device are nodes.
5. The incident effect range estimation device according to claim 1 , wherein
in the acquiring log information of an occurrence source device and in the acquiring log information of a communication destination device, acquiring log information according to a type of the incident.
6. The incident effect range estimation device according to claim 5 , wherein in the estimating, generating a graph in which the occurrence source device and the communication destination device are nodes.
7. The incident effect range estimation device according to claim 1 , wherein
in the estimating, generating a graph in which the occurrence source device and the communication destination device are nodes.
8. The incident effect range estimation device according to claim 7 , wherein
in the estimating, determining a priority level of the node, based on a structure of the generated graph.
9. The incident effect range estimation device according to claim 8 , wherein
in determining a priority level of the node, based on centrality of the nodes.
10. The incident effect range estimation device according to claim 8 , wherein
in determining a priority level of the node, based on community clustering of nodes.
11. The incident effect range estimation device according to claim 7 , wherein
in generating the graph, determining whether to add the communication destination device as nodes based on a time of the change point of the log information.
12. An non-transitory computer readable incident effect range estimation method in an incident effect range estimation device, the method comprising,
by the incident effect range estimation device:
acquiring log information of an occurrence source device related to occurrence of an incident;
acquiring, based on the log information of the occurrence source device, log information of a communication destination device being a communication destination of the occurrence source device;
acquiring, based on the log information of a communication destination device acquired, log information of a next communication destination device being a next communication destination;
calculating, based on the log information acquired, a weight score related to communication for each communication destination device, the weight score calculated based on at least one of; a change point of the communication destination, a change point of a communication protocol, a change rate of a communication amount, and a change rate of a communication frequency;
recursively repeating acquisition of the log information of the next communication destination device until the weight score calculated for the next communication destination device becomes equal to or smaller than a threshold value; and
estimating an extent of influence of the incident, based on the log information of the communication destination device and the log information of the next communication destination device acquired.
13. A non-transitory computer readable storage medium storing therein an incident effect range estimation program for causing a computer to perform incident effect range estimation processing,
the incident effect range estimation processing including:
acquiring log information of an occurrence source device related to occurrence of an incident;
acquiring, based on the log information of the occurrence source device, log information of a communication destination device being a communication destination of the occurrence source device;
acquiring, based on the log information of a communication destination device acquired, log information of a next communication destination device being a next communication destination;
calculating, based on the log information acquired, a weight score related to communication for each communication destination device, the weight score calculated based on at least one of; a change point of the communication destination, a change point of a communication protocol, a change rate of a communication amount, and a change rate of a communication frequency;
recursively repeating acquisition of the log information of the next communication destination device until the weight score calculated for the next communication destination device becomes equal to or smaller than a threshold value; and
estimating an extent of influence of the incident, based on the log information of the communication destination device and the log information of the next communication destination device acquired.