JP7685929B2 - Attack scenario analysis device and attack scenario analysis method - Google Patents

Description

The present invention relates to an attack scenario analysis device and an attack scenario analysis method.

In recent years, the threat of cyber attacks has not only emerged in traditional information systems, but also in computer systems in the industrial sector (industrial control systems).

Generally, the life cycle of computer equipment used in industrial control systems is longer than that of information systems. For this reason, it is not rare for legacy operating systems (OS) and software that are no longer supported by their vendors to still be in use.

In addition, from the perspective of availability, it is difficult to apply security patches easily, so in terms of security, they often have more vulnerabilities than information systems.

On the other hand, IoT (Internet of Things) technology has been actively introduced to improve production efficiency, etc., and as a result of an increasing number of cases where various systems are interconnected via the Internet, industrial control systems have become convenient targets for attackers.

Cyber attacks on industrial control systems, including critical infrastructure, can have a significant social impact and, in some cases, could lead to health and safety accidents.

There is also an increasing threat of Advanced Persistent Threat (APT) attacks, which continuously launch sophisticated attacks targeting target systems with the intent of causing such damage.

An effective approach to combating such sophisticated attacks is to predict the sequence of steps and actions an attacker takes from the time they infiltrate a target system to the time they achieve their goal (hereafter referred to as an "attack scenario" or "scenario") from the attacker's perspective, evaluate the risks, and then implement the necessary countermeasures.

Here, it is important to evaluate "risk" from both the perspectives of risk to the attacker and risk to the victim.

The former is related to the feasibility of an attack scenario, such as the "risk that an attack will be costly to carry out" or the "risk that an attack will fail."

The latter relates to the damage and impact on victims (systems targeted by cyber attacks), such as the "amount of damage caused by the attack" and the "impact on human life and the environment caused by the attack."

Patent Document 1 provides a method and program for identifying cyber-attack routes and assigning an evaluation value to the risk in an information processing system including multiple computers, etc. Specifically, it identifies vulnerabilities in devices on the attack route, and then compares them with a database that stores evaluation values for each predefined vulnerability, enabling a risk evaluation for the entire system being analyzed.

WO2020/195228

However, industrial control systems operate with a wide variety of control devices, including IoT devices, so collecting vulnerability information for all devices that make up the system requires a huge amount of time and effort.

As a result, in situations where time and labor resources are limited, it is often difficult to apply traditional vulnerability-based risk analysis methods to industrial control systems. As a result, it is currently difficult to conduct risk analysis from the perspectives of both the risks to attackers and the risks to victims.

The present invention aims to enable efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

The attack scenario analysis device of the present invention that solves the above-mentioned problems is characterized by comprising: a memory unit that retains information on the costs required by an attacker to carry out a cyber-attack, information on damage caused by the attacker's attacking actions, and a cyber-attack state transition model for each type of device in the system to be attacked; an attack scenario generation unit that generates a plurality of cyber-attack scenarios by combining the state transition models corresponding to each type of device included in the system to be analyzed; and a risk assessment unit that calculates each evaluation value of a risk to the attacker based on the cost information and a risk to the system based on the damage information that arise sequentially as the attacker transitions his/her attacking actions in accordance with the scenario, and specifies an evaluation value of the risk related to the scenario based on each evaluation value.

In addition, the attack scenario analysis method of the present invention is characterized in that an information processing device executes a process of generating a plurality of cyber-attack scenarios by storing, in a memory unit, information on the costs required by an attacker in a cyber-attack, information on damage caused by the attacker's attacking actions, and a cyber-attack state transition model for each type of equipment in the system to be attacked, and combining the state transition models corresponding to each type of equipment included in the system to be analyzed, and a process of calculating each evaluation value of a risk to the attacker based on the cost information and a risk to the system based on the damage information that arise sequentially as the attacker transitions his/her attacking actions in accordance with the scenario, and identifying an evaluation value of a risk related to the scenario based on each evaluation value.

According to the present invention, it is possible to generate an attack scenario from an attacker's perspective from the configuration information of the system being analyzed, without having to individually identify vast amounts of vulnerability information, and to perform risk analysis from the perspectives of both the attacker and the system being analyzed. In other words, it is possible to perform efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

4 is a flowchart illustrating a process of the attack scenario analysis device according to the first embodiment. FIG. 1 is a system configuration diagram of an attack scenario analysis device according to first to third embodiments. 1 is a diagram illustrating an example of configuration information of a system to be analyzed according to the first to third embodiments. FIG. 2 is a diagram illustrating an example of a state transition model of an attacker according to the first to third embodiments. FIG. 2 is a diagram illustrating an example of a network configuration of a system to be analyzed according to the first to third embodiments. FIG. 13 is a diagram illustrating an example of a schematic diagram of an attack scenario according to the first and second embodiments. FIG. 2 is a diagram illustrating an example of an attack scenario according to the first embodiment. A figure showing an example of attack scenario information related to the first embodiment. FIG. 2 is a diagram showing an example of risk assessment information according to the first embodiment. 10 is a diagram illustrating an example of an analysis result of the attack scenario analysis device output to the input/output device according to the first embodiment. FIG. 13 is a flowchart illustrating a process of an attack scenario analysis device according to a second embodiment. FIG. 13 is a diagram showing technical information used by an attacker to take an action to transition a state according to the second embodiment. A figure showing an example of attack scenario information relating to the second embodiment. 13 is a flowchart illustrating a process of an attack scenario analysis device according to a third embodiment. A figure showing an example of attack scenario information relating to the third embodiment.

[First embodiment]
<Attack scenario analysis method flow>

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A first embodiment of the present invention will now be described with reference to the accompanying drawings. FIG 1 is a diagram showing a process flow of an attack scenario analysis method performed by an attack scenario analysis device 10.

Below, we will provide an overview of each step in the flowchart in Figure 1. First, the attack scenario analysis device 10 accepts and acquires user input of system configuration information 161 of the system to be analyzed via an appropriate input/output interface (step S1).

Then, the attack scenario analysis device 10 automatically generates an attack scenario by combining the system configuration information 161 acquired in S1 with an attacker's state transition model 162 (commonly known as a "cyber kill chain") that is individually defined for each device type of the system (step S2).

The attack scenario analysis device 10 also analyzes the risks to the attacker and the victim individually for the attack scenario generated in S2 and assigns an evaluation value (step S3).

Here, the victim refers to the system that is attacked by the attacker. Also, "risk to the victim" and "risk to the system under analysis" are synonymous.

Then, the attack scenario analysis device 10 analyzes the risk of the entire attack scenario based on the assessment values of the risks to the attacker and the victim, which were assessed individually in S3 above, and calculates an assessment value (step S4).

Finally, the attack scenario analysis device 10 links the attack scenario to the risk assessment value and outputs it to the user of the input/output device 17 (step S5), and ends the processing.

<Configuration of the attack scenario analysis device>
FIG. 2 shows an example of a system configuration in which the functions of the attack scenario analysis device 10 described above are realized by a computer.

In this case, the attack scenario analysis device 10 includes a CPU (Central Processing Unit) 11, a memory 12, an input/output interface 13, a storage device 14, and the like, which are connected to each other via a bus or the like.
It is composed of the following:

The CPU 11 is a central processing unit that controls the attack scenario analysis device 10. When the attack scenario analysis device 10 is running, the CPU 11 deploys the processing program group 15 stored in the storage device 14 into the memory 12 and executes it.

Memory 12 is, for example, a RAM (Random Access Memory) and is used as a working area when CPU 11 executes a program.

In addition, the input/output interface 13 is an interface that outputs the processing results of the CPU 11 to an external input/output device 17.

The input/output device 17 is a device that allows the user to input and output data to the attack scenario analysis device 10, and is mainly composed of a keyboard, mouse, display, etc.

The storage device 14 is configured, for example, as a hard disk drive (HDD) or a solid state drive (SSD). The information stored in the storage device 14 is broadly divided into a processing program group 15 and a storage unit 16.

The processing program group 15 is a program that executes processes S1 to S5 in FIG. 1. The information input unit 151 is a program that executes step S1, the attack scenario generation unit 152 is a program that executes step S2, the risk assessment unit 153 is a program that executes steps S3 and S4, and the analysis result output unit 154 is a program that executes step S5. The learning unit 155 included in the processing program group 15 is used only in the third embodiment.

The storage unit 16 also serves as an area for storing a database that stores input/output data processed by the processing program group 15. The storage unit 16 includes system configuration information 161, information transition model 162, attack scenario information 163, risk assessment information 164, and technical information 165. Note that the technical information 165 is mainly used in the second and third embodiments.

Below, each piece of information stored in the memory unit 16 is explained in relation to the detailed functions of the processing program group 15.

The system configuration information 161 is information about the devices that make up the system to be analyzed, and is input by the user via the information input unit 151.

Figure 3 shows an example of system configuration information 161 in this embodiment. The system configuration information 161 includes a device ID (identifier) 1611, a name 1612, a type 1613, an OS 1614, a connection network 1615, a security level 1616, and an importance level 1617.

Of these, ID 1611 is an identifier that uniquely represents the device. Name 1612 is the name of the device, which in the example shown in FIG. 3 would be "Notebook PC 1," "Data Server 1," "Monitoring PC 1," "PLC 1," and "PLC 2."

Type 1613 is the type of device, and in the example shown in Figure 3, it would be "general IT business terminal," "control monitoring terminal," or "control controller."

OS 1614 is information about the OS installed in each device, and in the example shown in Figure 3, it would be either a "general-purpose OS" or a "proprietary OS."

The connection network 1615 is information about the network to which each device is connected.
In the example of FIG. 3, there are three networks: an "information network", a "control network", and the "Internet".

Security level 1616 indicates the security level (level of security measures) of each device. In this embodiment, security level 1616 has three levels, 1 to 3. The higher the security level number, the more adequate the security measures are implemented.

The value of security level 1616 may also be set based on whether a pre-defined security policy is met, such as whether patches are applied regularly or whether the latest antivirus software is always installed.

Importance 1617 shows the results of evaluating the importance of each device in the system being analyzed from three perspectives: security confidentiality 1617A, integrity 1618B, and availability 1619C.

In this embodiment, confidentiality 1617A, integrity 1618B, and availability 1619C are evaluated using three categories: High, Low, and None.

For example, if confidentiality 1617A is rated "High," this indicates that if the device falls victim to a cyber attack and its confidentiality is compromised, it could lead to a serious information leak.

In addition, if confidentiality 1617A is "Low", it means that there is a minor information leak, and if it is "None", it means that it will not develop into an information leak.

Similarly, with regard to integrity 1617B, the extent to which a cyber attack on the relevant device would result in serious information tampering, and with regard to availability 1617C, the extent to which a cyber attack on the relevant device would result in serious business interruption, are evaluated by an appropriate person with knowledge, and the results are stored.

In addition, for confidentiality 1617A, integrity 1618B, and availability 1619C, a method of giving quantitative evaluation values may be adopted, rather than the qualitative evaluation using High, Low, and None as shown in FIG. 3.

Next, the state transition model will be explained with reference to FIG. 4. State transition model 162 shows the tactical level state transitions when an attacker carries out a cyber attack.

In other words, a state transition model represents the transition of a series of actions (attack actions) when an attacker attacks each device. The state transition model 162 differs for each type of device and is defined individually.

Figure 4 shows an example of state transition model 162. State transition model 162 is defined for each device type 1613 defined in Figure 3. In other words, state transition model 162 can only be selected from device types predefined in device type 1613 in Figure 3.

For example, the state transition models shown in FIG. 4 are state transition model 1621 applicable to a "general IT business terminal" defined in device type 1613 in FIG. 3, and state transition model 1622 similarly applicable to a "control monitoring terminal."

In addition, in the state transition model 162, it is predefined which elements of confidentiality, integrity, and availability in the target system will be damaged when an attacker reaches each state through a specified attack action.

For example, Figure 4 shows that when an attacker reaches the "take-out" state, the "confidentiality" of the general IT business terminal is damaged, when the "response control" state is reached, the "integrity" of the control monitoring terminal is damaged, and when the "control obstruction" state is reached, the "availability" of the control monitoring terminal is damaged.

The attack scenario information 163 is information on the attack scenario generated by the attack scenario generation unit 152. As described above, an attack scenario in this invention refers to a series of paths and attacking actions that an attacker takes from the time he or she infiltrates a targeted system to the time he or she achieves his or her objective.

The device that an attacker first accesses may be specified by the user in the information input section 151, or may be automatically selected from the information entered in the connection network 1615 of the system configuration information 161. For example, a device connected to the Internet may be set as the entry point for the attack.

Similarly, the device that the attacker will ultimately target may be specified by the user in the information input section 151, or may be automatically selected from the information entered in the importance 1617 of the system configuration information 161. For example, a device for which availability 1617A, confidentiality 1617B, and availability 1617C are all set to "High" may be set as the target of the attack.

Once the attack scenario analysis device 10 has determined the device that the attacker will access first and the final target device, it automatically searches for the attack path based on the information on the connection network 1615 in the system configuration information 161.

Figure 5 is a diagram showing the system configuration information 161 shown in Figure 3 as a network configuration diagram. In this embodiment, we will explain how to generate an attack scenario, assuming that the attacker will first access a notebook PC 1 connected to the Internet, and that the attack target device is a monitoring PC 1.

First of all, regarding the attack path, consider the shortest path, "notebook PC1 → monitoring PC1," as an example. In this case, the attack scenario analysis device 10 can model the actions taken by the attacker on notebook PC1 and monitoring PC1 by referring to the state transition model 162 in Figure 4 that corresponds to the devices.

According to the system configuration information 161 in FIG. 3, the type of notebook PC 1 is a "general IT business terminal" and the type of monitoring PC 1 is a "control monitoring device."

Therefore, the attack scenario analysis device 10 can model the attacker's behavior on the notebook PC 1 using the state transition model 1621 of a general IT business terminal in Figure 4.

The attack scenario analysis device 10 can also model the attacker's behavior on the monitoring PC 1 using the state transition model 1622 of the control monitoring terminal in Figure 4. Then, by combining these, an attack scenario can be generated.

Figure 6 shows a schematic diagram of an attack scenario generated from the above combination. An action ID, which is a unique identifier, is assigned to each attack action in which the attacker transitions between states. In the case of the attack scenario in Figure 6, action IDs 1 to 11 are assigned.

In addition, in Figure 6, an action assigned the action ID "1" is displayed as "Action 1," and the same display format is used for each action with an action ID of 2 to 11.

The attack route in the attack scenario in Figure 6 is fixed as "Notebook PC1 → Monitoring PC1", but the attacker's behavior can take one of the following four patterns:

[Attack Scenario ID: 1]
Action 1 → Action 2 → Action 6 → Action 7 → Action 8 → Action 9 → Action 10

[Attack Scenario ID: 2]
Action 1 → Action 2 → Action 6 → Action 7 → Action 8 → Action 9 → Action 11

[Attack scenario ID: 3]
Action 1 → Action 2 → Action 3 → Action 4 → Action 5 → Action 7 → Action 8 → Action 9 → Action 10

[Attack Scenario ID: 4]
Action 1 → Action 2 → Action 3 → Action 4 → Action 5 → Action 7 → Action 8 → Action 9 → Action 11

Each attack scenario is assigned an attack scenario ID, which is a unique identifier. Figure 7 shows a schematic diagram of an attack scenario with an attack scenario ID of 1 as an example.

In the attack scenario analysis device 10, even if the attack path is the same, if the attacker's state transitions are different, they are recognized as separate attack scenarios. In other words, since there are four state transition patterns for a single attack path of "notebook PC1 → monitoring PC1", the attack scenario generation unit 152 identifies them as four separate attack scenarios. These attack scenarios are stored as attack scenario information 163 together with the assigned attack scenario IDs.

Figure 8 is an example of attack scenario information 163, and is an example of a table storing information on an attack scenario with the above attack scenario ID "1". In the attack scenario information 163, attack steps 1631 indicating the order of the attack, action IDs 1632, details 1633 of each action ID, attack cost 1634, and damage impact 1635 are stored in association with each other. The attack cost 1634, damage impact 1635, combined value 1636, and overall risk assessment value 1637 will be described later.

In addition, the risk assessment information 164 stores information about the risk of the attack scenario analyzed by the risk assessment unit 153. In the present invention, risk assessment is performed on the attacker's state transition actions from both the attacker's and victim's perspectives.

By focusing on the attacker's state transition behavior, it becomes possible to evaluate risk by taking into account the attacker's state both before and after the transition, improving accuracy compared to evaluating risk for the attacker's state alone.

In this embodiment, for example, the "cost of attack" is used as an index for evaluating the risk to an attacker. The cost of attack refers to the effort an attacker expends when carrying out a cyber attack.

When the cost of attack is high, the risk to an attacker increases, so it is likely that the attacker will choose an attack scenario with as low an attack cost as possible. Therefore, it is necessary to prioritize the implementation of countermeasures against attack scenarios with low attack costs.

As described above, the attack cost is calculated for the attacker's action of transitioning states. The device type 1613, OS 1614, connection network 1615, and security level 1616 in the system configuration information 161 in FIG. 3 may be used to calculate the attack cost. For example, when taking an action that transitions to an "intrusion" state, the attack cost may be calculated to be higher if the action goes through an internal company network such as an information network or control network, compared to if the action goes through the Internet. According to this evaluation method, in the case of FIG. 6, when comparing actions 1 and 7 that transition to the same "intrusion" state, the attack cost of action 7 is calculated to be higher than that of action 1.

As an indicator for evaluating the risk to an attacker, other than "attack cost," any indicator related to the risk to an attacker can be used, such as "attack difficulty," which indicates the difficulty of an attack, or "attack detection rate," which indicates the possibility that an attack will be detected, and these can be combined to calculate the evaluation value of the risk to an attacker.

On the other hand, as an index for evaluating the risk to the victim, for example, "damage impact degree" is used. Damage impact degree is an index that quantifies the damage impact that will be caused when the system under analysis is hit by a cyber attack. Attackers are likely to carry out attack scenarios with as high a damage impact degree as possible. For this reason, it is necessary to prioritize the implementation of countermeasures against attack scenarios with a high damage impact degree.

Similar to the attack cost, the damage impact is calculated for the attacker's state transition actions. The damage impact may be calculated using the confidentiality 1617A, integrity 1617B, and availability 1617C of the importance 1617 in the system configuration information 161 in FIG. 3.

For example, in the schematic diagram of the attack scenario in Figure 6, if an attacker performs action 4, the confidentiality of notebook PC 1 will be compromised. Since the confidentiality 1617A of notebook PC 1 is assigned "Low," this means that if an attacker performs action 4, it will lead to a minor information leak in the system.

Similarly, if an attacker performs action 10, the integrity of monitoring PC 1 will be compromised. Since "High" is assigned to the integrity 1617C of monitoring PC 1, it means that if an attacker performs action 10, it will lead to the tampering of critical information for the system. When quantifying the degree of damage and impact of these, it is possible to refer to the items in CVSS v3 (Common Vulnerability Scoring System v3) that evaluate the impact of attacks.

As an indicator for assessing the risk to the victim, in addition to the "impact of damage," any indicator related to the risk to the victim, such as the "estimated amount of damage," which indicates the expected amount of damage, may be used, and these may be combined to calculate the assessment value of the risk to the victim.

Figure 9 shows an example of risk assessment information 164. In this embodiment, an attack cost 1642, which is an assessment value of the risk to the attacker, and a damage impact level 1643, which is an assessment value of the risk to the victim, are associated with an action ID 1641.

This risk assessment information 1642 is also input to the attack cost 1634 and damage impact 1635 in FIG. 8. The total value 1636 in the attack scenario information 163 in FIG. 6 is set to the total attack cost and damage impact for the entire attack scenario.

Moreover, a value obtained by dividing the total damage impact degree by the total attack cost is stored in the overall risk evaluation value 1637. In other words, it can be interpreted that an attack scenario with a high overall risk evaluation value can cause a large damage impact degree with a low attack cost.

In this embodiment, the above-mentioned simple division is used as the method for calculating the overall risk assessment value 1637, but the calculation method is not important as long as the value is derived using both the risk assessment values for the attacker and the victim.

Figure 10 shows an example in which the analysis result output unit 154 reads the attack scenario information 163 and displays it on the input/output device 17 as an attack scenario analysis result 1540. The attack scenario analysis result 1540 includes a table 1549, a sort button 1546, a change risk assessment method button 1547, and a batch file output button 1548.

Of these, table 1549 associates attack scenario ID 1541, attack cost 1542, damage impact level 1543, and overall risk assessment value 1544.

The attack cost 1542 and damage impact 1543 are stored with the combined value 1636 calculated in FIG. 8, and the overall risk assessment value 1544 is stored with the same value as the overall risk assessment value 1637 calculated in FIG. 8, for the corresponding attack scenario ID 1541.

In addition, when the detail display button 1545 is pressed, the attack scenario analysis device 10 calls up detailed information about the corresponding attack scenario from the attack scenario information 163 and displays it to the user.

In addition, when the detail display button 1545 is pressed, the attack scenario analysis device 10 may display a schematic diagram of the corresponding attack scenario as shown in FIG. 7. Alternatively, the attack scenario may be displayed in a tabular format as shown in FIG. 8.

In addition, when the sort button 1546 is pressed, the attack scenario analysis device 10 sorts, i.e. rearranges, the display contents of table 1549 by attack scenario ID 1541, attack cost 1542, damage impact level 1543, and overall risk assessment value 1544.

Depending on the user, it may be possible to evaluate the risk of an attack scenario using either the attack cost 1542 or the damage impact 1543 rather than the overall risk assessment value 1544.

When the risk assessment method change button 1547 is pressed, the attack scenario analysis device 10 changes the method of assessing the risk to the attacker and the victim. For example, the method of assessing the risk to the attacker may be switched from "attack cost" to "attack detection rate."

In addition, when the batch file output button is pressed, the attack scenario analysis device 10 outputs both the display contents of table 1549 and the display contents obtained by pressing the detailed display button 1545 in a file at once.

Second Embodiment
The second embodiment of the present invention will be described below with reference to the drawings. In the first embodiment, when generating an attack scenario as shown in FIG. 6, a single action ID is assigned to an action that transitions from a certain state to the next state.

However, there are many different technologies to realize each action. For example, if we take the action of transitioning from one state to an "intrusion" state, various technologies are used to realize this action, such as "infecting a system with malware via targeted email" or "abusing remote login services."

In this embodiment, we will describe an attack scenario analysis device 10 that makes it possible to generate and evaluate attack scenarios separately using the techniques adopted in the above examples.

The attack scenario analysis device 10 according to the second embodiment has a configuration in which technical information 165 is added to the memory unit 16 of the attack scenario analysis device according to the first embodiment.

Figure 11 is a diagram showing an example of the flow of an attack scenario analysis method by the attack scenario analysis device 10 according to the second embodiment.

Steps S11, S13, S14, and S15 in the flow of FIG. 11 are the same processes as steps S1, S3, S4, and S5, respectively, in the flow of FIG. 1.

On the other hand, in step S12, unlike step S2, the attack scenario analysis device 10 automatically generates an attack scenario by comprehensively combining the input system configuration information 121 with the attacker's state transition model 162, which is defined individually for each type of device, and the technical information 165.

Figure 12 shows an example of technical information 165. Technical information 165 stores a list of states 1652 to which an attacker will transition in a series of attack scenarios, and technologies 1653 for achieving those state transitions.

Each implementation technology 1653 is defined with a technology ID 1651 that uniquely identifies the technology, a technology difficulty 1654 that indicates the difficulty of using the technology, an implementation effort 1655 that indicates the effort required for an attack using the technology, an attack detection rate 1656 that indicates the possibility that the attack will be detected, a damage impact 1657 that indicates the impact of damage caused by an attack using the technology, and an estimated damage amount 1658 that indicates the amount of damage caused by an attack using the technology.

In FIG. 12, the technical difficulty 1654, implementation effort 1655, attack detection rate 1656, damage impact 1657, and estimated damage amount 1658 are each rated as "High," "Mid," or "Low," but a quantitative score may also be given.

Figure 13 shows an example of attack scenario information 163A that stores attack scenarios generated in the second embodiment. In the attack scenario generation unit 152 of the second embodiment, attack scenarios are generated for all combinations of behavior IDs and technology IDs, and are stored in the attack scenario information 163A.

In FIG. 13, an example of an attack scenario with an attack scenario ID of "1" is displayed, and each attack step 1631A is associated with a combination of an action ID 1632A and a technique ID 1638A, and its details 1633A.

Also, as in FIG. 8, the attack scenario analysis device 10 calculates the attack cost 1634A and the damage impact 1635A for each attack step, and calculates the overall risk assessment value 1637A based on the sum of these values 1636A.

In the second embodiment, when calculating the attack cost 1634A, in addition to the device type 1613, OS 1614, connection network 1615, and security level 1616 in the system configuration information 161 in FIG. 3, the evaluation of the technical difficulty 1654 in FIG. 12 may be taken into consideration.

For example, when taking action to move into an "intrusion" state, if a technology with a technical difficulty rating of "High" is used, the attack cost will be calculated to be higher than if a technology with a "Low" rating is used.

Finally, the analysis result output unit 154 reads the attack scenario information 163A and outputs it to the analysis result output unit 154, thereby completing the cyber attack scenario evaluation in this embodiment.

[Third embodiment]
A third embodiment of the present invention will be described below with reference to the drawings. In the attack scenario analysis measures in the first and second embodiments, a method is adopted in which risk assessment values are calculated for all attack scenarios and output to the user. On the other hand, in this embodiment, an attack scenario analysis measure is described that extracts an optimal attack scenario for an attacker through analysis using reinforcement learning and outputs the extracted attack scenario to the user.

The attack scenario analysis device 10 according to the third embodiment has a configuration in which a learning unit 155 is added to the processing program group 15 of the attack scenario analysis device according to the first embodiment, and technical information 165 is added to the memory unit 16.

Figure 14 is a diagram showing an example of a flow of an attack scenario analysis method by the attack scenario analysis device 10 according to the third embodiment. Steps S111, S112, and S113 in the flow of Figure 14 perform the same processes as steps S11, S12, and S13 in Figure 11, respectively.

In step S114, the learning unit 155 defines a reward for each action based on the assessment value of the risk to the attacker and victim for each action calculated in step 113, and repeats the learning process.

The above-mentioned learning method may be any method, and for example, Q-learning, which is a method of reinforcement learning, may be used. In this Q-learning, rewards are given for all actions that can be selected in each state, and an action value function Q is learned. In step S113, an assessment value of the risk to the attacker and victim is calculated for each combination of action and technology.

In order to fit this embodiment into the Q-learning framework, each combination of behavior and skill may be redefined as an individual behavior. For example, a combination of behavior ID XX and skill ID YY and a combination of behavior ID XX and skill ID ZZ may be treated as different behaviors, and the respective behavior IDs may be redefined as XX-YY and XX-ZZ.
13 shows an example in which the action IDs in FIG. 13 are redefined as described above.

Regarding rewards for actions, a higher reward may be set for actions that pose a higher risk to the victim, and a lower reward may be set for actions that pose a higher risk to the attacker.

In step S115, the learning unit 155 selects an attack scenario that is a combination of actions and techniques that maximizes the action value function Q learned in the above-mentioned step S114, and outputs the selected attack scenario to the analysis result output unit 154. This completes the cyber attack scenario evaluation in this embodiment.

The above describes in detail the best mode for carrying out the present invention, but the present invention is not limited to this, and various modifications are possible without departing from the spirit of the present invention.

This embodiment enables efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

The description in this specification makes clear at least the following. That is, in the attack scenario analysis device of this embodiment, the storage unit may hold the state transition model for each type of device constituting the system, and the attack scenario generation unit may generate multiple scenarios by combining state transition models corresponding to the types of devices included in the system.

This makes it possible to generate scenarios with higher accuracy when information about the devices that make up the system is available. This in turn enables more efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

In the attack scenario analysis device of this embodiment, the storage unit may further store information on the costs required for the attack behavior, and the risk assessment unit may tally up the costs of each of the attack behaviors included in the scenario from at least one of the perspectives of the effort required for the attack, the difficulty of the attack, and the attack detection rate, which indicates the possibility that the attack will be detected, based on the cost information, and may treat the tally up costs as an assessment value of the risk to the attacker.

This makes it possible to more accurately consider the costs from the attacker's perspective when conducting risk assessments. This in turn enables more efficient risk analysis of cyber attacks against industrial control systems from both the attacker's and victim's perspectives.

In the attack scenario analysis device of this embodiment, the storage unit may further store information on damage caused by the attack behavior, and the risk assessment unit may tally up costs from at least one of the perspectives of a damage impact level representing the impact of damage caused by an attack and an estimated damage amount representing the estimated amount of damage caused by an attack for each of the attack behaviors included in the scenario based on the damage information, and may treat the tally up costs as an assessment value of the risk to the system.

This makes it possible to more accurately consider the costs of the system under attack and perform risk assessment. This in turn enables more efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

The attack scenario analysis device of this embodiment may further include an information input unit that accepts information input of the devices that make up the system.

This makes it possible to efficiently obtain device information that can improve the accuracy of scenario generation. Ultimately, this enables more efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

In addition, in the attack scenario analysis device of this embodiment, the attack scenario generation unit may select, in the scenario, the device that an attacker will access first in the system and the device that will be the final target, based on information regarding the importance of the devices in the system inputted by the information input unit.

This makes it possible to accurately identify the start/end of a scenario, which in turn enables more efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both attackers and victims.

The attack scenario analysis device of this embodiment may further include an analysis result output unit that displays a list of scenarios that link each scenario generated by the attack scenario generation unit with the evaluation value obtained for each scenario by the risk assessment unit.

This makes it possible to accurately present to the user the characteristics of each scenario. Ultimately, this enables more efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

In addition, in the attack scenario analysis device of this embodiment, the storage unit may further store information on the technology that realizes the attack behavior as the cost information, and the attack scenario generation unit may generate the scenario in the system by combining the state transition model and information on the technology that realizes the attack behavior in the state transition model based on the technology information.

This makes it possible to carry out various processes that take into account the technical characteristics of each attack action that makes up the scenario and the associated costs (for both the attacker and the victim). Ultimately, this enables more efficient risk analysis of cyber attacks against industrial control systems from the perspectives of both the attacker and the victim.

The attack scenario analysis device of this embodiment may further include a learning unit that defines a reward for a combination of the attack behavior in which the attacker transitions between states and the technology based on the risk assessment value, and performs reinforcement learning of the scenario.

This makes it possible to deploy a scenario obtained for one system to other systems with similar configurations and characteristics. This in turn enables more efficient risk analysis of cyber attacks on industrial control systems from the perspectives of both the attacker and the victim.

10 Attack scenario analysis device 11 CPU
12 Memory 13 Input/Output Interface 14 Storage Device 15 Processing Program Group 151 Information Input Unit 152 Attack Scenario Generation Unit 153 Risk Assessment Unit 154 Analysis Result Output Unit 155 Learning Unit 16 Storage Unit 161 System Configuration Information 162 State Transition Model 163 Attack Scenario Information 164 Risk Assessment Information 165 Technical Information

Claims (9)

A storage unit that stores information on costs required by an attacker to carry out a cyber-attack, information on damage caused by the attacking actions of the attacker, and a state transition model of a cyber-attack for each type of device of a system that is the target of the attack;
an attack scenario generation unit that generates multiple cyber-attack scenarios by combining the state transition models corresponding to the types of devices included in the system to be analyzed ;
a risk assessment unit that calculates an assessment value of a risk to the attacker based on the information on the cost and a risk to the system based on the information on the damage, which are sequentially generated as a result of the attacker transitioning his/her attack behavior in accordance with the scenario, and determines an assessment value of a risk related to the scenario based on the assessment values;
An attack scenario analysis device comprising: The risk assessment unit includes:
aggregating costs of each of the attacking actions included in the scenario from at least one of the viewpoints of effort required for the attack, difficulty of the attack, and attack detection rate indicating the possibility that the attack will be detected, based on the cost information, and using the aggregated costs as an evaluation value of the risk to the attacker;
2. The attack scenario analysis device according to claim 1, The risk assessment unit includes:
aggregating costs from at least one of the viewpoints of a damage impact level representing the impact of damage caused by an attack and an estimated damage amount representing the estimated damage amount caused by an attack for each of the attack actions included in the scenario based on the damage information, and using the aggregated costs as an evaluation value of the risk to the system;
2. The attack scenario analysis device according to claim 1, The attack scenario analysis device according to claim 1, further comprising an information input unit that accepts information input of devices that constitute the system. The attack scenario generation unit
a device that an attacker will access first in the system and a device that will be a final target in the system in the scenario are selected based on the information regarding the importance of the devices in the system inputted in the information input section;
5. The attack scenario analysis device according to claim 4. and an analysis result output unit that displays a list of scenarios in which each scenario generated by the attack scenario generation unit is associated with the evaluation value obtained for each scenario by the risk evaluation unit.
6. The attack scenario analysis device according to claim 5, The storage unit is
The cost information further includes information on a technique for realizing the attacking behavior;
The attack scenario generation unit
generating the scenario in the system by combining the state transition model with information on a technology that realizes an attack behavior in the state transition model based on the information on the technology;
3. The attack scenario analysis device according to claim 2. A learning unit that defines a reward for a combination of an attacking action in which an attacker transitions between states and the technique based on the risk evaluation value, and performs reinforcement learning on the scenario.
The attack scenario analysis device according to claim 7 . An information processing device,
A storage unit stores information on costs required by an attacker to carry out a cyber-attack, information on damage caused by the attacking actions of the attacker, and a state transition model of the cyber-attack for each type of device of the system that is the target of the attack ;
A process of generating multiple cyber-attack scenarios by combining the state transition models corresponding to the types of devices included in the system to be analyzed;
a process of calculating an evaluation value of a risk to the attacker based on the information on the cost and a risk to the system based on the information on the damage , which are sequentially generated as the attacker transitions his/her attack behavior in accordance with the scenario, and determining an evaluation value of a risk related to the scenario based on the evaluation values;
13. An attack scenario analysis method comprising:

Images