Information processing apparatus, information processing system, information processing method, and computer program

1. An information processing apparatus comprising:

an acquisition unit that directly or indirectly acquires information related to a first flow, information related to a second flow, and information related to a conversion that takes the first flow as input and the second flow as output, the first flow and the second flow organizing packets transferred in a monitored system into respective groups,

an alert acknowledgment unit that acknowledges alert information generated in the monitored system and including information capable of identifying at least one flow; and

a generation unit that generates, when the second flow is identified by the alert information, route information that includes at least one of the information related to the conversion and the information related to the first flow associated with the second flow in the information related to the conversion.

2. The information processing apparatus according to claim 1 , wherein

at least one of the information related to the first flow and the information related to the second flow includes information related to a source and a destination of a CAN (Controller Area Network) frame.

3. The information processing apparatus according to claim 1 , further comprising:

an abnormality handling unit that executes a process for handling an abnormality in accordance with the route information generated by the generation unit.

4. The information processing apparatus according to claim 3 , wherein

the route information includes information indicating one or more apparatuses related to transfer of a packet causing generation of the alert information, and

the process for handling an abnormality is a process to make a defense function provided in an apparatus indicated by the route information valid.

5. The information processing apparatus according to claim 3 , wherein

the route information includes information indicating one or more apparatuses related to transfer of a packet causing generation of the alert information, and

the process for handling an abnormality is a process to record a more detailed log related to an apparatus indicated by the route information than before the alert information is acknowledged.

6. The information processing apparatus according to claim 3 , wherein

the route information includes information indicating one or more apparatuses related to transfer of a packet causing generation of the alert information, and

the process for handling an abnormality is a process to identify a type of attack in accordance with an apparatus, of the one or more apparatuses, that interfaces with an element external to the monitored system.

7. An information processing system comprising:

the information processing apparatus according to claim 1 ;

a first storage that stores the information related to the first flow and the information related to the second flow; and

a second storage that stores the information related to the conversion.

8. The information processing system according to claim 7 , further comprising:

an abnormality detection unit, wherein

the first storage stores information related to a plurality of flows collected from apparatuses forming the monitored system,

the second storage stores information related to a plurality of conversions collected from apparatuses forming the monitored system,

the generation unit generates route information that connects a plurality of flows in accordance with input and outputs indicated by the information related to the conversion stored in the second storage, even when the alert information is not acknowledged, and

the abnormality detection unit detects an abnormality in the monitored system in accordance with the route information generated by the generation unit.