Attack graph processing device, method, and program
An attack graph processing device includes a node extraction unit which extracts a node relating to a rule classified into a predetermined group from an attack graph that is configured from one or more nodes indicating the state of a system to be diagnosed, or the state of the primary agent of an attack on the system to be diagnosed, and one or more edges indicating the relationship among a plurality of nodes, the attack graph being generated using rules indicating a condition in which the attack can be executed, and a graph configuration unit which simplifies the attack graph on the basis of the extracted node.
1. An attack graph processing device comprising:
a memory storing software instructions; and
one or more processors configured to execute the software instructions to:
extract a node relating to a rule classified into a predetermined group from an attack graph that is configured from one or more nodes indicating a state of a system to be diagnosed, or a state of a primary agent of an attack, which is a state of being able to log in or communicate with a certain host, on the system to be diagnosed, and one or more edges indicating a relationship among a plurality of nodes, the attack graph being generated using rules indicating a condition in which the attack can be executed; and
simplify the attack graph by deleting the one or more nodes that were not extracted.
2. The attack graph processing device according to claim 1 , wherein
the one or more processors are configured to execute the software instructions to simplify the attack graph by deleting nodes other than the extracted node from the attack graph.
3. The attack graph processing device according to claim 2 , wherein
the one or more processors are configured to execute the software instructions to extract the node using classification information that indicates the rule classified into the predetermined group.
4. The attack graph processing device according to claim 3 , wherein
the one or more processors are further configured to execute the software instructions to classify one or more rules into groups, and
the one or more processors are configured to execute the software instructions to generate the classification information indicating the rule classified into the predetermined group.
5. The attack graph processing device according to claim 3 , wherein
the classification information indicates the rule related to a behavior of the primary agent of the attack.
6. The attack graph processing device according to claim 5 , wherein
the one or more processors are further configured to execute the software instructions to classify one or more rules into groups, and
the one or more processors are configured to execute the software instructions to generate the classification information indicating the rule classified into the predetermined group.
7. The attack graph processing device according to claim 5 , wherein
the rule related to the behavior of the primary agent of the attack is the rule that contains information indicating an identifier of the vulnerability.
8. The attack graph processing device according to claim 7 , wherein
the one or more processors are further configured to execute the software instructions to classify one or more rules into groups, and
the one or more processors are configured to execute the software instructions to generate the classification information indicating the rule classified into the predetermined group.
9. The attack graph processing device according to claim 1 , wherein
the one or more processors are configured to execute the software instructions to extract the node using classification information that indicates the rule classified into the predetermined group.
10. The attack graph processing device according to claim 9 , wherein
the classification information indicates the rule related to a behavior of the primary agent of the attack.
11. The attack graph processing device according to claim 10 , wherein
the one or more processors are further configured to execute the software instructions to classify one or more rules into groups, and
the one or more processors are configured to execute the software instructions to generate the classification information indicating the rule classified into the predetermined group.
12. The attack graph processing device according to claim 10 , wherein
the one or more processors are further configured to execute the software instructions to generate an attack graph attached with the classification information on the basis of the rule attached with the classification information, and
the one or more processors are configured to execute the software instructions to extract the node using the classification information from the generated attack graph.
13. The attack graph processing device according to claim 10 , wherein
the rule related to the behavior of the primary agent of the attack is the rule that contains information indicating an identifier of the vulnerability.
14. The attack graph processing device according to claim 13 , wherein
the one or more processors are further configured to execute the software instructions to classify one or more rules into groups, and
the one or more processors are configured to execute the software instructions to generate the classification information indicating the rule classified into the predetermined group.
15. The attack graph processing device according to claim 13 ,
the one or more processors are further configured to execute the software instructions to generate an attack graph attached with the classification information on the basis of the rule attached with the classification information, and
the one or more processors are configured to execute the software instructions to extract the node using the classification information from the generated attack graph.
16. The attack graph processing device according to claim 9 , wherein
the one or more processors are further configured to execute the software instructions to classify one or more rules into groups, and
the one or more processors are configured to execute the software instructions to generate the classification information indicating the rule classified into the predetermined group.
17. The attack graph processing device according to claim 9 , wherein
the one or more processors are further configured to execute the software instructions to generate an attack graph attached with the classification information on the basis of the rule attached with the classification information, and
the one or more processors are configured to execute the software instructions to extract the node using the classification information from the generated attack graph.
18. The attack graph processing device according to claim 1 , further comprising:
an attack graph display which displays a simplified attack graph.
19. An attack graph processing method performed by a computer and comprising:
extracting a node relating to a rule classified into a predetermined group from an attack graph that is configured from one or more nodes indicating a state of a system to be diagnosed, or a state of a primary agent of an attack, which is a state of being able to log in or communicate with a certain host, on the system to be diagnosed, and one or more edges indicating a relationship among a plurality of nodes, the attack graph being generated using rules indicating a condition in which the attack can be executed; and
simplifying the attack graph by deleting the one or more nodes that were not extracted.
20. A non-transitory computer-readable recording medium storing an attack graph processing program causing executable by a computer to perform processing comprising:
extracting a node relating to a rule classified into a predetermined group from an attack graph that is configured from one or more nodes indicating a state of a system to be diagnosed, or a state of a primary agent of an attack, which is a state of being able to log in or communicate with a certain host, on the system to be diagnosed, and one or more edges indicating a relationship among a plurality of nodes, the attack graph being generated using rules indicating a condition in which the attack can be executed; and
simplifying the attack graph by deleting the one or more nodes that were not extracted.