Analysis system, method, and program
An analysis unit 6 generates one or more pairs of a start point fact which is a fact representing possibility of the attack in a device that is a start point and an end point fact which is a fact representing possibility of the attack in the device that is an end point, analyzes, for each pair, whether or not it is possible to derive the end point fact from the start point fact, based on facts representing states of the devices generated based on information regarding the device that is the start point and information regarding the device that is the end point, the start point fact, and one or more analysis rules for analyzing the attack, and generates an attack scenario in a case where it is possible to derive the end point fact from the start point fact.
1. An analysis method performed by one or more computers and comprising:
generating a fact which is data representing a security situation of a system to be diagnosed, based on information regarding each device included in the system to be diagnosed;
generating one or more pairs of a start point fact which is a fact representing an attack in the device that is a start point and an end point fact which is a fact representing an attack in the device that is an end point;
analyzing, for each pair, whether or not it is possible to trace from the start point fact to the end point fact, based on facts representing states of the devices generated based on information regarding the device that is the start point and information regarding the device that is the end point, the start point fact, and one or more analysis rules for analyzing the attack; and
generating an attack scenario which is information that represents a transition relationship of a combination of the device, an attack state, and privileges that correspond to the attack state according to the start point fact and the end point fact, in a case where it is possible to trace from the start point fact to the end point fact.
2. An analysis method performed by one or more computers and comprising:
receiving an input of an attack graph regarding a system to be diagnosed;
searching for, in the attack graph, a pair of a combination node indicating a combination of a device, an attack state, and privileges, and a combination node next to the combination node; and
generating an attack scenario which is information that represents a transition relationship of a combination of the device, the attack state, and the privileges that correspond to the attack state, for each pair of the combination nodes;
displaying the generated attack scenario on a display device by
displaying a second icon representing the privileges in a first icon representing the device;
displaying a third icon representing the attack state in the second icon, for each of a start point combination node and an end point combination node in a pair of the combination nodes; and
displaying an edge extending from the third icon corresponding to the start point combination node to the third icon corresponding to the end point combination node; and
omitting displaying the second icon in a predetermined case.
3. An analysis system comprising:
a memory storing instructions; and
a processor configured to execute the instructions to:
generate a fact which is data representing a security situation of a system to be diagnosed, based on information regarding each device included in the system to be diagnosed; and
generate one or more pairs of a start point fact which is a fact representing an attack in the device that is a start point and an end point fact which is a fact representing an attack in the device that is an end point;
analyze, for each pair, whether or not it is possible to trace from the start point fact to the end point fact, based on facts representing states of the devices generated based on information regarding the device that is the start point and information regarding the device that is the end point, the start point fact, and one or more analysis rules for analyzing the attack; and
generate an attack scenario which is information that represents a transition relationship of a combination of the device, an attack state, and privileges that correspond to the attack state according to the start point fact and the end point fact, in a case where it is possible to trace from the start point fact to the end point fact.
4. The analysis system according to claim 3 , wherein
the processor
generates a combination of one of the devices, one of multiple types of attack states defined in advance, and one of privileges that correspond to the attack state, as the start point fact, and
generates a combination of one of the devices, one of the multiple types of the attack states, and one of privileges that correspond to the attack state, as the end point fact.
5. The analysis system according to claim 3 , wherein
the processor displays the generated attack scenario on a display device.
6. The analysis system according to claim 5 , wherein
the processor displays the attack scenario by displaying a second icon representing the privileges in a first icon representing the device, displaying a third icon representing the attack state in the second icon, for each of the start point fact and the end point fact, and displaying an edge extending from the third icon corresponding to the start point fact to the third icon corresponding to the end point fact, and
omits displaying the second icon in a predetermined case.
7. The analysis system according to claim 5 , wherein
when a first device and a second device are designated from outside, the processor displays the attack scenario from the first device to the second device.
8. The analysis system according to claim 5 , wherein
when one device is designated from outside, the processor displays the attack scenario from the one device to another device.
9. The analysis system according to claim 5 , wherein
the processor identifies a network topology of devices included in the system to be diagnosed,
wherein the processor displays the attack scenario superimposed on the network topology.
10. The analysis system according to claim 5 , wherein
in the case where it is possible to trace from the start point fact to the end point fact, the processor generates an attack pattern that includes at least an attack condition, an attack result, and an attack means, and
wherein the processor displays the attack pattern associated with the attack scenario along with the attack scenario.
11. An analysis system comprising:
a memory storing instructions; and
a processor configured to execute the instructions to:
receive an attack graph regarding a system to be diagnosed, and
search for, in the attack graph, a pair of a combination node indicating a combination of a device, an attack state, and privileges, and a combination node next to the combination node;
generate an attack scenario which is information that represents a transition relationship of a combination of the device, the attack state, and the privileges that correspond to the attack state, for each pair of the combination nodes;
display the generated attack scenario on a display device by
displaying a second icon representing the privileges in a first icon representing the device;
displaying a third icon representing the attack state in the second icon, for each of a start point combination node and an end point combination node in a pair of the combination nodes; and
displaying an edge extending from the third icon corresponding to the start point combination node to the third icon corresponding to the end point combination node; and
omit displaying the second icon in a predetermined case.
12. The analysis system according to claim 11 , wherein
when a first device and a second device are designated from outside, the processor displays the attack scenario from the first device to the second device.
13. The analysis system according to claim 11 , wherein
when one device is designated from outside, the processor displays the attack scenario from the one device to another device.
14. The analysis system according to claim 11 , wherein
the processor identifies a network topology of the devices included in the system to be diagnosed,
wherein the processor displays the attack scenario superimposed on the network topology.
15. The analysis system according to claim 11 , wherein
the processor generates an attack pattern that includes at least an attack condition, an attack result, and an attack means, for each pair of the combination nodes, and
wherein the processor displays the attack pattern associated with the attack scenario along with the attack scenario.
16. A non-transitory computer-readable recording medium storing an analysis program executable by a computer to perform processing comprising:
generating a fact which is data representing a security situation of a system to be diagnosed, based on information regarding each device included in the system to be diagnosed; and
generating one or more pairs of a start point fact which is a fact representing an attack in the device that is a start point and an end point fact which is a fact representing an attack in the device that is an end point, analyzing, for each pair, whether or not it is possible to trace from the start point fact to the end point fact, based on facts representing states of the devices generated based on information regarding the device that is the start point and information regarding the device that is the end point, the start point fact, and one or more analysis rules for analyzing the attack; and
generating an attack scenario which is information that represents a transition relationship of a combination of the device, an attack state, and privileges that can correspond to the attack state according to the start point fact and the end point fact, in a case where it is possible to trace from the start point fact to the end point fact.