Evaluation method, information processing apparatus, and storage medium
A non-transitory computer-readable storage medium storing a program that cause a processor included in an information processing apparatus to execute a process, the process includes collecting a plurality of types of cyberattack information; evaluating a number of types of cyberattacks in which feature information of the cyberattack appears based on the collected cyberattack information; and when receiving specification of the feature information of a cyberattack, responding evaluation results of the number of types of cyberattacks in which the specified feature information of the cyberattack appears.
1. A non-transitory computer-readable storage medium storing a program that cause a processor included in an information processing apparatus to execute a process, the process comprising:
collecting a plurality of cyberattack information related to cyberattacks;
classifying the plurality of cyberattack information into a plurality of groups based on types of the cyberattacks;
evaluating, for each of a plurality of feature information of the cyberattacks, a degree of a number of types of cyberattacks in which the feature information appears based on the plurality of groups; and
when receiving specification of the feature information of a cyberattack, responding evaluation results of the degree of the number of types of the cyberattacks in which the specified feature information of the cyberattack appears.
2. The storage medium according to claim 1 , wherein
the responding includes responding a type of the cyberattack in which the specified feature information of the cyberattack appears.
3. The storage medium according to claim 1 , wherein
the responding includes responding a weight value indicating a degree of appearance of the specified feature information of the cyberattack for each of the types of the cyberattacks.
4. The storage medium according to claim 1 , wherein
the responding includes responding evaluation results of the number of types of the cyberattacks in which the specified combination of the feature information of the cyberattack appears when specification of a combination of the feature information of the cyberattack is received.
5. The storage medium according to claim 1 , wherein
the collecting includes collecting various cyber threat intelligences as the feature information by crawling preset sites on Internet.
6. The storage medium according to claim 1 , wherein the process comprising
extracting elements indicating features of the cyberattacks from the plurality of cyberattack information as the feature information.
7. An evaluation method executed by a processor included in an information processing apparatus, the evaluation method comprising:
collecting a plurality of cyberattack information related to cyberattacks;
classifying the plurality of cyberattack information into a plurality of groups based on types of the cyberattacks;
evaluating, for each of a plurality of feature information of the cyberattacks, a degree of a number of types of cyberattacks in which the feature information appears based on the plurality of groups; and
when receiving specification of the feature information of a cyberattack, responding evaluation results of the degree of the number of types of the cyberattacks in which the specified feature information of the cyberattack appears.
8. The evaluation method according to claim 7 , wherein
the responding includes responding a type of the cyberattack in which the specified feature information of the cyberattack appears.
9. The evaluation method according to claim 7 , wherein
the responding includes responding a weight value indicating a degree of appearance of the specified feature information of the cyberattack for each of the types of the cyberattacks.
10. The evaluation method according to claim 7 , wherein
the responding includes responding evaluation results of the number of types of the cyberattacks in which the specified combination of the feature information of the cyberattack appears when specification of a combination of the feature information of the cyberattack is received.
11. An information processing apparatus comprising:
a memory; and
a processor coupled to the memory and configured to:
collect a plurality of cyberattack information related to cyberattacks;
classify the plurality of cyberattack information into a plurality of groups based on types of the cyberattacks;
evaluate, for each of a plurality of feature information of the cyberattacks, a degree of a number of types of cyberattacks in which the feature information appears based on the plurality of groups; and
when receiving specification of the feature information of a cyberattack, respond evaluation results of the degree of the number of types of the cyberattacks in which the specified feature information of the cyberattack appears.
12. The information processing apparatus according to claim 11 , wherein the processor is configured to
respond a type of the cyberattack in which the specified feature information of the cyberattack appears.
13. The information processing apparatus according to claim 11 , wherein the processor is configured to
respond a weight value indicating a degree of appearance of the specified feature information of the cyberattack for each of the types of the cyberattacks.
14. The information processing apparatus according to claim 11 , wherein the processor is configured to
respond evaluation results of the number of types of the cyberattacks in which the specified combination of the feature information of the cyberattack appears when specification of a combination of the feature information of the cyberattack is received.