JP7801965B2 - Log analysis query creation support device and log analysis query creation support method - Google Patents

Description

The present invention relates to a log analysis query creation support device, a log analysis query creation support method, and a log analysis query creation support program.

In recent years, cyber attacks have become increasingly sophisticated, and traditional security equipment alone may not be able to fully prevent them. To prevent cyber attacks, there is technology that analyzes cyber attack threats.

For example, the technology described in Patent Document 1 executes threat attacks in various simulated systems with different environments and logs, and records the logs. The rule generation device then compares the environmental information, log information, and attack impact information for each simulated system to analyze the conditions for a successful threat attack and the impact of the threat attack. By using the technology described in Patent Document 1 to analyze the conditions for a successful attack for all threats, it becomes easy to analyze threats in a specific environment.

International Publication No. 2020/246011

However, various variants of threats and new attack methods are created every day, making it difficult to recognize all threats. For this reason, it is difficult to use the technology described in Patent Document 1 to analyze the conditions for a successful attack for all threats. Therefore, even if the technology described in Patent Document 1 is used to analyze threats in a specific environment, it may not be possible to properly detect the threats.

Threat hunting is also being conducted, in which the impact of threats is analyzed from logs in the environment being analyzed (referred to as the target environment). In threat hunting, a hunting query is created to identify the anticipated threat, assuming that the threat has already attacked the target environment. The hunting query is then used to search the logs of the target environment to detect the impact of the threat, and the impact of the anticipated threat is analyzed. Here, in order to detect the impact of the anticipated threat from the logs of the target environment without false positives or oversights, the hunting query must preferably include information on the characteristics of the anticipated threat. For this reason, there is a demand for technology that makes it easy to create hunting queries that preferably include information on the characteristics of the anticipated threat.

Therefore, an object of the present invention is to provide a log analysis query creation support device, a log analysis query creation support method, and a log analysis query creation support program that make it easy to create hunting queries that preferably include information on the characteristics of anticipated threats.

To achieve the above objective, one aspect of the log analysis query creation support device of the present invention is a log analysis query creation support device that receives a hunting query used to detect the impact of threats on a target environment from logs, and includes: an information acquisition ease calculation unit that calculates an information acquisition ease that indicates the ease of collecting query-related articles that are highly relevant to information on attacks of a specific threat that can be identified by the hunting query; and a query threat impact calculation unit that calculates an accuracy that indicates how accurately the impact of an attack by a specific threat that can be identified by the hunting query can be detected when the hunting query is used to search the execution logs to detect the impact of the attacks by the specific threats on the target environment, and calculates an operation commonality that indicates the extent to which the hunting query can detect common attack procedures among the detection results for the multiple specific threats when the hunting query is used to search the execution logs to detect the impact of the attacks by the multiple specific threats on the target environment, in the execution logs to detect the impact of the attacks by the multiple specific threats on the target environment.

Another aspect of the log analysis query creation support method of the log analysis query creation support device of the present invention is a log analysis query creation support method that receives a hunting query used to detect the impact of threats on a target environment from logs and causes the processor of the log analysis query creation support device to execute the log analysis query. The method calculates an information acquisition ease indicating the ease of collecting query-related articles that are highly relevant to the hunting query, calculates an accuracy indicating how accurately the impact of attacks by multiple specific threats identified by the hunting query can be detected when the hunting query is used to search the execution logs for each of the specific threats when the hunting query is used to search the execution logs for each of the specific threats when the hunting query is used to search the execution logs for each of the specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to search the execution logs for each of the specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of attacks by the multiple specific threats when the hunting query is used to detect the impact of the ...

A representative embodiment of the present invention makes it easy to create hunting queries that preferably include information about the characteristics of anticipated threats.

Details of at least one implementation of the subject matter disclosed herein are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the disclosed subject matter will become apparent from the following disclosure, drawings, and claims.

FIG. 1 illustrates an example of a functional configuration diagram of a log analysis system. FIG. 1 illustrates an example of a hardware and software configuration diagram of a log analysis system. FIG. 10 is a diagram illustrating an example of a data configuration of a query management table. FIG. 10 is a diagram illustrating an example of a data configuration of a simulated environment table. FIG. 10 is a diagram illustrating an example of the data configuration of an attack information table. FIG. 10 is a diagram illustrating an example of a data configuration of validity data. FIG. 10 is a diagram illustrating an example of an analysis screen displayed on an analyst terminal. FIG. 10 is a diagram illustrating an example of a flowchart showing the overall processing of the embodiment. FIG. 10 is a diagram illustrating an example of a flowchart illustrating an information acquisition ease calculation process according to an embodiment. FIG. 10 is a diagram illustrating an example of a flowchart illustrating a query threat impact calculation process according to the embodiment. FIG. 10 is a diagram illustrating an example of a flowchart showing a manual attack execution process according to an embodiment. FIG. 10 is a diagram illustrating an example of a flowchart illustrating a query effectiveness calculation process according to the embodiment.

Embodiments of the present invention will be described below with reference to the drawings. The examples are illustrative of the present invention, and have been omitted or simplified as appropriate for clarity of explanation. The present invention can also be implemented in a variety of other forms. Unless otherwise specified, each component may be singular or plural.

The position, size, shape, range, etc. of each component shown in the drawings may not represent the actual position, size, shape, range, etc. in order to facilitate understanding of the invention. Therefore, the present invention is not necessarily limited to the position, size, shape, range, etc. disclosed in the drawings.

As examples of various types of information, expressions such as "table," "list," and "queue" may be used, but various types of information may also be expressed using other data structures. For example, various types of information such as "XX table," "XX list," and "XX queue" may also be expressed as "XX information." When describing identification information, expressions such as "identification information," "identifier," "name," "ID," and "number" are used, but these are interchangeable.

When there are multiple components with the same or similar functions, they may be described using the same reference numeral with different subscripts. Also, when there is no need to distinguish between these multiple components, the subscripts may be omitted.

In the embodiments, processing performed by executing a program may be described. Here, a computer executes the program using a processor (e.g., a CPU or GPU) and performs the processing defined in the program using storage resources (e.g., memory) and interface devices (e.g., communication ports). Therefore, the entity performing the processing by executing the program may be the processor. Similarly, the entity performing the processing by executing the program may be a controller, device, system, computer, or node having a processor. The entity performing the processing by executing the program may be any computing unit, and may include a dedicated circuit that performs specific processing. Here, a dedicated circuit is, for example, an FPGA (Field Programmable Gate Array), ASIC (Application Specific Integrated Circuit), or CPLD (Complex Programmable Logic Device).

The program may be installed from the program source into a computer equipped with a storage device having a non-volatile memory element (hereinafter referred to as a non-volatile storage device). The program source may be, for example, a non-volatile storage medium readable by a program distribution server equipped with a non-volatile storage device or a computer equipped with a non-volatile storage device. When the program source is distributed from a program distribution server, the program distribution server may include a processor and a non-volatile storage device that stores the program to be distributed, and the processor of the program distribution server may read the program to be distributed from the storage device and distribute it to other computers. Furthermore, in the embodiments, two or more programs may be realized as one program, or one program may be realized as two or more programs.

The log analysis system 1 of the embodiment is a system that uses a threat hunting technique to analyze logs in an analysis target environment using a hunting query. When a hunting query is input, the log analysis query creation support device 100 evaluates the effectiveness of the hunting query and presents the evaluation results to a user such as an analyst.

<<System configuration of log analysis system 1, Figures 1 and 2>>
Fig. 1 is a diagram showing an example of a functional configuration diagram of a log analysis system 1. As shown in Fig. 1, the log analysis system 1 includes a log analysis query creation support device 100, an analyst terminal 200, target simulation environment devices 300a to 300n, a log management device 400, and a network NW1. The network NW1 is also connected to a network NW2. The network NW2 is connected to analysis target devices 500a to 500n and data sharing devices 600a to 600n.

The log analysis query creation support device 100 is a device that receives a hunting query for analyzing logs of analysis target devices 500a-500n in analysis target environments 510a-510n using threat hunting techniques, calculates the effectiveness of the input hunting query, and outputs the result. The analysis target environments 510a-510n of the analysis target devices 500a-500n are, for example, environments with user terminals of client organizations or web environments, but the present invention is not limited to the types of these analysis target environments 510a-510n.

The analyst terminal 200 is a terminal used by a user such as an analyst of threat hunting that uses hunting queries. The analyst or other user inputs hunting queries, etc., and transmits information about the input hunting queries, etc., to the log analysis query creation support device 100.

The target simulated environment devices 300a-300n are devices configured with target simulated environments 310a-310n that simulate the analysis target environments 510a-510n of the analysis target devices 500a-500n. The target simulated environments 310a-310n are not limited to types of environments such as physical environments or virtual environments. It is desirable for the target simulated environments 310a-310n to completely simulate the analysis target environments 510a-510n of the analysis target devices 500a-500n using snapshots of the virtual environment, etc., but a similar environment may also be configured, such as an environment in which the same OS and applications as the analysis target environments 510a-510n are installed.

The log management device 400 stores a log table 410 that saves logs from the target simulated environment devices 300a-300n and the analysis target devices 500a-500n. The log management device 400 receives raw logs created in environments such as a customer environment, a cloud environment, or an analyst environment, and stores the received logs in the log table 410. The log management device 400 can send the logs stored in the log table 410 to devices such as the log analysis query creation support device 100 that it accesses.

The analysis target devices 500a-500n are devices to be analyzed. The analysis target devices 500a-500n are set in the analysis target environments 510a-510n. The data sharing devices 600a-600n are devices that store information on the execution procedures of threat attacks.

There is no limit to the number of target simulated environment devices 300a-300n, target simulated environments 310a-310n, analysis target devices 500a-500n, analysis target environments 510a-510n, and data sharing devices 600a-600n, as long as they are one or more.

Network NW1 is a local area network (LAN). Network NW2 is the Internet. Networks NW1 and NW2 may be any network, such as the Internet, a local area network, a wired network, or a wireless network.

Figure 2 shows an example of the hardware and software configuration of the log analysis system 1.

As shown in FIG. 1, the log analysis query creation support device 100 has, as its functional configuration, a processing execution unit 111, an information acquisition ease calculation unit 112, a query threat impact calculation unit 113, a query effectiveness calculation unit 114, and a log analysis execution unit 115. As shown in FIG. 2, the log analysis query creation support device 100 also has, as its hardware configuration, a processor 101, a main memory device 102, a secondary memory device 103, an NWIF 104, an input/output device 105, and a bus 106 connecting these. The log analysis query creation support device 100 can be implemented using an information processing device such as a general server device, personal computer, or mobile terminal.

The processor 101 controls each component of the log analysis query creation support device 100, reads data and programs stored in the secondary storage device 103 into the main storage device 102, and executes the processing defined by the program. The processing execution unit 111 is realized by the processor 101 reading the processing execution program 111a stored in the secondary storage device 103 into the main storage device 102 and executing it. Similarly, the information acquisition ease calculation unit 112, the query threat impact calculation unit 113, the query validity calculation unit 114, and the log analysis execution unit 115 are realized by the processor 101 reading the information acquisition ease calculation program 112a, the query threat impact calculation program 113a, the query validity calculation program 114a, and the log analysis execution program 115a stored in the secondary storage device 103 into the main storage device 102 and executing them. In this specification, when processing is described using a sentence with the processing execution unit 111, information acquisition ease calculation unit 112, query threat impact calculation unit 113, query validity calculation unit 114, or log analysis execution unit 115 as the subject, this indicates that the processor 101 of the log analysis query creation support device 100 is executing the processing execution program 111a, information acquisition ease calculation program 112a, query threat impact calculation program 113a, query validity calculation program 114a, and log analysis execution program 115a that realize the relevant functional units.

Furthermore, a program that combines the processing execution program 111a, information acquisition ease calculation program 112a, query threat impact calculation program 113a, query validity calculation program 114a, and log analysis execution program 115a into one set is referred to as a log analysis query creation support program.

The main memory device 102 is a RAM or similar device that has volatile memory elements and stores programs and data executed by the processor 101.

The secondary storage device 103 is a device such as an HDD (Hard Disk Drive) or SSD (Solid State Drive) that has non-volatile storage elements and stores programs, data, etc. The secondary storage device 103 stores a processing execution program 111a, an information acquisition ease calculation program 112a, a query threat impact calculation program 113a, a query effectiveness calculation program 114a, a log analysis execution program 115a, a query management table 121, a simulated environment table 122, an attack information table 123, and an effectiveness table 124.

The query management table 121, details of which will be described later using FIG. 3, stores information about hunting queries. The simulated environment table 122, details of which will be described later using FIG. 4, stores information about the target simulated environments 310a-310n of the target simulated environment devices 300a-300n, respectively. The attack information table 123, details of which will be described later using FIG. 5, stores information about the execution of attacks on threats that can be identified by hunting queries (referred to as specific threats in this specification). The effectiveness table 124, details of which will be described later using FIG. 6, stores information about methods for evaluating the effectiveness of hunting queries.

In addition, the secondary storage device 103 is installed with a processing execution program 111a, an information acquisition ease calculation program 112a, a query threat impact calculation program 113a, a query effectiveness calculation program 114a, and a log analysis execution program 115a.

The NWIF 104 is connected to the network NW1 and is an interface capable of transmitting and receiving data via the networks NW1 and NW2 between the analyst terminal 200, the target simulated environment devices 300a-300n, the log management device 400, the analysis target devices 500a-500n, and the data sharing devices 600a-600n. The log analysis query creation support device 100 uses the NWIF 124 to transmit and receive data via the networks NW1 and NW2 between the analyst terminal 200, the target simulated environment devices 300a-300n, the log management device 400, the analysis target devices 500a-500n, and the data sharing devices 600a-600n.

The input/output device 105 includes input devices such as a keyboard and mouse that accept operations from users such as analysts, and output devices such as a touch panel, display, and speaker that output information. The log analysis query creation support device 100 can use the input device to acquire information entered by operations by users such as analysts, and can use the output device to present information to users such as analysts by, for example, displaying it on a screen.

The analyst terminal 200, target simulated environment devices 300a-300n, log management device 400, analysis target devices 500a-500n, and data sharing devices 600a-600n can be configured using the same hardware resources as the log analysis query creation support device 100. The log management device 400 stores a log table 410 in its secondary storage device.

When a user such as an analyst inputs input information (in the example of Figure 7, the threat category, threat type, target environment, and hunting query in input field 710) and the log analysis query creation support device 100 acquires the input information, the processing execution unit 111 executes an overall process (see Figure 8) for calculating the effectiveness of the hunting query. The overall process is an overall process that executes an information acquisition ease calculation process, a query threat impact calculation process, a query effectiveness calculation process, etc.

The information acquisition ease calculation unit 112 executes an information acquisition ease calculation process (see Figure 9) to calculate the information acquisition ease of the input hunting query.

Ease of information acquisition indicates the ease of collecting query-related articles that are highly relevant to information on attacks related to the specific threat in the hunting query.

The query threat impact calculation unit 113 executes the query threat impact calculation process (see Figures 10 and 11). In the query threat impact calculation process, attacks by multiple threats (referred to as specific threats in this specification) that can be identified by a hunting query are executed against the target simulated environments 310a to 310n of the target simulated environment devices 300a to 300n, and the behavior commonality, environment selection, and accuracy are calculated.

Operation commonality indicates the degree to which a hunting query can detect common attack steps among the detection results for multiple specific threats when the impact of attacks by multiple specific threats is detected by searching the execution logs of each specific threat when they are executed against the target environment.

Environment selectivity indicates how many different types of target environments can be targeted by an attack and detect threats when a hunting query detects the impact of attacks by multiple specific threats in each execution log when attacks on a target environment are carried out by multiple specific threats.

Accuracy represents how accurately the impact of a specific threat attack can be detected when searching the execution logs with a hunting query to detect the impact of each specific threat attack on the target environment.

The query effectiveness calculation unit 114 executes a query effectiveness calculation process (see Figure 12) that calculates the effectiveness of a hunting query based on the ease of information acquisition, commonality of operations, environment selection, and accuracy.

The log analysis execution unit 115 accesses the log management device 400, acquires logs from the analysis target devices 500a-500n, searches the acquired logs using a hunting query, and detects the impact of threats from the acquired logs.

<<Data Structure of Log Analysis System 1, FIGS. 3 to 6>>
Next, the data configurations of various data used in the log analysis system 1 will be described with reference to Figures 3 to 6. Note that the field configurations of the query management table 121, simulated environment table 122, attack information table 123, and validity table 124 shown in Figures 3 to 6 and described below are examples and can be changed as appropriate.

Figure 3 shows an example of the data configuration of the query management table 121. The query management table 121 stores information about hunting queries. The query management table 121 stores records whose fields are a query ID 301, a threat category 302, a type 303, a hunting query 304, a target environment 305, an ease of related information acquisition 306, an operation commonality 307, an environment selectivity 308, an accuracy 309, whether or not execution was performed 310, and the number of execution result hits 311.

Query ID 301 is a field that stores an identifier assigned to uniquely identify the type of query. For example, a number is assigned to query ID 301.

Threat category 302, which will be described in more detail below, is a field that stores information about the threat category included in the input information entered by a user such as an analyst. Threat category 302 stores, for example, the name of the malware or the name of the attacker.

Type 303, which will be described in more detail below, is a field that stores the type of threat contained in the input information entered by a user such as an analyst. Type 303 stores, for example, the family name of malware in threat category 302 or the name of the attacker.

Hunting query 304, which will be described in more detail below, is a field that stores a hunting query included in the input information entered by a user such as an analyst. Here, the hunting query is a hunting query entered by a user such as an analyst to verify its validity.

Target environment 305, which will be described in detail later, is a field that stores information about the environment in which threat attacks that can be identified by hunting queries are verified, which is included in the input information entered by users such as analysts.

Related information acquisition ease 306 is a field that stores the related information acquisition ease for a hunting query, which will be described later. Operation commonality 307 is a field that stores the operation commonality for a hunting query, which will be described later. Environment selectivity 308 is a field that stores the operation commonality for a hunting query, which will be described later. Accuracy 309 is a field that stores the accuracy for a hunting query, which will be described later.

Execution Status 310 is a field that stores a numerical value indicating whether the target environment of the inspection target was inspected using a hunting query. If the target environment of the inspection target was inspected using a hunting query, a 1 is stored in Execution Status 310. On the other hand, if the target environment of the inspection target was not inspected using a hunting query, a 0 is stored in Execution Status 310.

The execution result hit count 311 stores the number of threats detected when the target environment was inspected using the hunting query.

Figure 4 shows an example of the data structure of the simulated environment table 122. The simulated environment table 122 stores information about the target simulated environment of each of the target simulated environment devices 300a to 300n. The simulated environment table 122 stores records with the following fields: environment ID 401, simulated environment name 402, attack environment attribute 403, OS 404, introduced application 405, and environment installation location 406. Note that a record does not need to include information for all of these fields, or may not include information for some of the fields.

The environment ID 401 is a field that stores an identifier assigned to uniquely identify the target simulated environments 310a to 310n of the target simulated environment devices 300a to 300n. For example, a number is assigned to the environment ID 401.

The simulated environment name 402 is a field that stores the name of the target simulated environment 310a-310n of the target simulated environment device 300a-300n being managed, so that it can be easily understood by users such as analysts.

Attack environment attributes 403 are fields that store the attributes of the target simulated environments 310a-310n of the target simulated environment devices 300a-300n.

Target environment 404 is a field that stores information about the OS of the target simulated environments 310a-310n of the target simulated environment devices 300a-300n. The extent of damage caused by threat attacks, such as attacks by attackers or malware, varies depending on the OS in the execution environment of the threat attack, so the target environment 404 field is set so that OS information can be confirmed.

Installed applications 405 is a field that stores applications installed in the target simulated environments 300a-300n of the target simulated environment devices 300a-300n. The installed applications 405 field is set because the extent of damage caused by attacks by threats such as attackers or malware varies depending on the applications installed in the affected environment.

Environment installation location 406 is a field that stores the installation location (e.g., URL or IP address) of the target simulated environment device 300a-300n for executing a threat attack.

Figure 5 shows an example of the data configuration of the attack information table 123. The attack information table 123 stores information about the execution of attacks of specific threats that can be identified by hunting queries. The attack information table 123 stores records with the following fields: attack ID 501, query ID 502, attack name 503, attack information source 504, environment ID 505, attack start time 506, and attack end time 507.

Attack ID 501 is a field that stores an identifier assigned to uniquely identify the type of threat attack that was carried out. Attack ID 501 is assigned a number, for example.

Query ID 502 is a field that stores the identifier of the query ID 301 in the query management table 121 corresponding to the record.

Attack name 503 is a field that stores the name of the threat that carried out the attack, to make it easier for users to understand.

Attack information source 504 is a field that stores information about the location where information on the execution procedures of a threat attack was obtained.

Environment ID 505 is a field that stores the identifier of the environment ID 401 of the corresponding simulated environment table 122.

Attack start time 506 is a field that stores information related to the start time of a threat attack, for use in filters when searching execution logs. Attack end time 507 is a field that stores information related to the end time of a threat attack, for use in filters when searching execution logs.

Figure 6 shows an example of the data structure of the validity table 124. The validity table 124 stores information related to the method for calculating the validity of a hunting query. The validity table 124 stores records with the following fields: threat category 601, threat type 602, validity calculation formula 603, and validity threshold 604.

Threat category 601 is a field that stores information about a threat category similar to threat category 302 in query management table 121, and the effectiveness calculation formula 603 and effectiveness threshold 604 described below are applied to records that contain a threat category 302 that matches threat category 601.

Threat type 602 is a field that stores information about the type of threat, similar to type 303 in query management table 121. For records that include type 303 that matches threat type 602, the log analysis query creation support device 100 calculates the effectiveness by applying the effectiveness determination effectiveness calculation formula 603 and effectiveness threshold 604, which will be described later.

Effectiveness calculation formula 603 is a field that stores a calculation formula for determining effectiveness. Figure 6 shows an example of a calculation formula that calculates the effectiveness as the average value of the ease of information acquisition, the commonality of actions, the environmental selectivity, and the accuracy, but the effectiveness calculation formula 603 may be a formula other than this.

The validity threshold 604 is a field that stores the threshold for determining whether the validity calculated by the validity calculation formula 603 is valid.

<<Processing Procedure of the Log Analysis Query Creation Support Device 100, FIGS. 7 to 12>>
Next, the processing procedure of the log analysis query creation support device 100 will be described. The analyst operates the analyst terminal 200 to cause the analyst terminal 200 to access the log analysis query creation support device 100. When accessed from the analyst terminal 200, the log analysis query creation support device 100 transmits analysis screen information, which is information about an analysis screen, to the analyst terminal 200. The analysis screen information includes information about the configuration of the analysis screen and information indicating that the analysis screen is to be displayed on the analyst terminal 200. As will be described below, the analysis screen is configured to be able to accept input of input information including a threat category, a threat type, a target environment, and a hunting query, and an input indicating that the input information is to be sent to the log analysis query creation support device 100.

Figure 7 is an explanatory diagram showing an example of an analysis screen displayed on the analyst terminal 200. The analysis screen 700 shown in Figure 7 includes an input field 710, an output field 720, and an execute query button 730. The input field 710 is a field where the analyst enters information. The input field 710 includes a threat category input field 711, a type input field 712, a target environment input field 713, a hunting query input field 714, and a verify button 715.

The threat category input field 711 is a field for entering the target threat category, such as malware or attacker. The type input field 712 is a field for entering the type name of a specific threat related to the hunting query, which is more detailed than threat categories such as Emotet for malware types or APT3 for attacker types. The target environment input field 713 is a field for entering the target environment to be analyzed. The hunting query input field 714 is a field for entering the hunting query. When the verify button 715 is pressed, input information including the threat category information entered in the threat category input field 711, the type name entered in the type input field 712, the target environment information entered in the target environment input field 713, and the hunting query entered in the hunting query input field 714 is sent from the analyst terminal 200 to the log analysis query creation support device 100. The log analysis query creation support device 100 executes the overall processing described below to calculate the effectiveness of the hunting query entered in the hunting query input field 714 based on the input information, and displays the calculation result in the output field 720.

The output field 720 includes a query validity display field 721, a hunting query display field 722, an information acquisition ease related information display field 723, a query verification result display field 724, and a re-verify button 725. The query validity display field 721 is a field that displays a validity judgment value indicating whether or not a hunting query is valid. The hunting query display field 722 is a field that displays the hunting query for which the validity judgment value is calculated. The hunting query display field 722 allows the hunting query to be edited.

The information acquisition ease related information display field 723 is a field that displays information related to the information acquisition ease of the hunting query in the hunting query display field 722. The query verification result display field 724 is a field that displays information related to the query verification result. When the re-verification button 725 is pressed, the hunting query in the hunting query display field 722 and the
The threat category entered in the threat category input field 711, the type name entered in the type input field 712, and the target environment entered in the target environment input field 713 are transmitted from the analyst terminal 200 to the log analysis query creation support device 100. Upon receiving this information, the log analysis query creation support device 100 executes the overall processing described below, calculates the effectiveness of the hunting query entered in the hunting query input field 714 based on the received information, and displays the calculation result in the output field 720.

When the query execution button 730 is pressed, the logs of the analysis target devices 500a-500n are searched for threats using the hunting query most recently created between the hunting query in the hunting query input field 714 and the hunting query in the hunting query display field 722.

Note that the information entered in the input field 710 and the information presented in the output field 720 shown in Figure 7 are merely examples, and the input information is not limited to these.

<Overall processing, Figure 8>
FIG. 8 is a flowchart illustrating an example of the overall processing executed by the log analysis query creation support device 100. The overall processing, an example of which is shown in FIG. 8, is executed by the processing execution unit 111 of the log analysis query creation support device 100. As described above, when a user such as an analyst enters input information in the input fields of the analysis screen, an example of which is shown in FIG. 7 (in the example of FIG. 7, the threat category, threat type, target environment, and hunting query in input field 710) and presses the verify button 715, the log analysis query creation support device 100 acquires the input information. Upon acquiring the input information, the log analysis query creation support device 100 causes the processing execution unit 111 to execute the overall processing, an example of which is shown in FIG. 8.

The log analysis query creation support device 100 stores the acquired input information in the query management table 121 (step S801).

Next, the log analysis query creation support device 100 extracts and stores all records associated with the target environment included in the input information from the simulated environment table 122.
The records in the simulated environment table 122 contain information on the target simulated environments 300a to 300n of the target simulated environment devices 300a to 300n, which are the analysis target environments of the analysis targets. If the log analysis query creation support device 100 is able to extract at least one record associated with the target environment, the target environment included in the input information is one of the target simulated environments 300a to 300n, which are the analysis target environments, and can be considered to be the environment to be analyzed. Hereinafter, the environment included in the record extracted in step S802 will be referred to as the "attack target simulated environment."

Next, the log analysis query creation support device 100 determines whether the target environment included in the input information for the hunting query is the environment to be analyzed (step S803). If the target environment included in the input information is determined to be at least one of the environments to be analyzed, and therefore the target environment included in the input information is the environment to be analyzed (i.e., the simulated attack target environment) (step S803: YES), the process proceeds to step S804. On the other hand, if the target environment included in the input information is not one of the environments to be analyzed, and therefore the target environment included in the input information is not the environment to be analyzed (step S803: NO), the hunting query for the environment to be analyzed is not a query that can be used to analyze the environment to be analyzed, and the log analysis query creation support device 100 terminates the overall process.

Next, the log analysis query creation support device 100 executes an information acquisition ease calculation process (step S804). Details will be described later using FIG. 9 , but in the information acquisition ease calculation process, the log analysis query creation support device 100 collects information related to hunting queries that can be acquired from the Internet and calculates the information acquisition ease.

Next, the log analysis query creation support device 100 executes a query threat impact calculation process (step S805). Details will be described later using Figures 10 and 11, but in the query threat impact calculation process, the log analysis query creation support device 100 executes attacks of multiple specific threats that can be identified by the hunting query in the environment to be analyzed, analyzes the execution log with the hunting query, and calculates the operational commonality, environmental selectivity, and accuracy of the hunting query.

Next, the log analysis query creation support device 100 executes a query validity calculation process (step S806). Details will be described later using FIG. 12, but in the query validity calculation process, the log analysis query creation support device 100 calculates whether the hunting query is valid based on the information acquisition ease, operation commonality, environment selectivity, and accuracy.

Next, the log analysis query creation support device 100 transmits the analysis results of the hunting query, such as its validity, to the analyst terminal 200, and ends the process (step S807). Upon receiving the analysis results, the analyst terminal 200 presents the analysis results on the analysis screen (see FIG. 7).

<Information Acquisition Ease Calculation Process, FIG. 9>
9 is a flowchart illustrating an example of the information accessibility calculation process according to the embodiment. The information accessibility calculation process illustrated in FIG. 9 is executed by the information accessibility calculation unit 112 of the log analysis query creation support device 100.

The log analysis query creation support device 100 extracts query feature words, which are words that represent the characteristics of the hunting query, from the hunting query (step S901). Query feature words include, for example, malware names such as "AgentTesla," formatting words such as "html," threat behaviors, and program-related words such as "macro."

Next, the log analysis query creation support device 100 searches the Internet using the query feature words extracted in step S901 and collects query-related articles that are articles related to the query feature words (step S902).

Next, the log analysis query creation support device 100 calculates the relevance with the query feature words for each of the query-related articles collected in step S902, calculates the number of query-related articles whose relevance is higher than a predetermined relevance threshold as the ease of information acquisition, and terminates the process (step S903).

The relevance may be any numerical value that represents the degree of relevance between the hunting query and the query-related article. The relevance can be calculated, for example, using a calculation method (e.g., the TF method) based on the number of times words included in the query feature words appear, which can calculate the relevance between the query feature words and the query-related article, or the Doc2vec algorithm. It can be considered that the greater the number of query-related articles with a relevance higher than the relevance threshold, the easier it will be to obtain information about attacks on specific threats in the hunting query. Therefore, the ease of information acquisition represents the ease of collecting query-related articles that are highly relevant to information about attacks on specific threats in the hunting query.

In addition, in step S903 described above, articles from specified websites containing information related to the query feature words may be collected via crawling via the Internet. Articles collected using a method (e.g., topic analysis) that can extract website articles related to information on the threat type in the hunting query may be considered to be query-related articles with a relevance higher than the relevance threshold. Here, the website articles collected by crawling may be scraped to remove unnecessary information before obtaining related articles. Alternatively, website articles related to various threats may be collected in advance by crawling and stored in a threat article table created for storing the articles, and the threat article table may be used in the processing of step S903.

<Query threat impact calculation process, FIG. 10>
10 is a flowchart illustrating an example of a query threat impact calculation process according to the embodiment. The query threat impact calculation process illustrated in FIG. 10 is executed by the query threat impact calculation unit 113 of the log analysis query creation support apparatus 100.

The log analysis query creation support device 100 backs up the current state of the attack target simulated environment (step S1001). Specifically, for example, if the attack target environment is a virtual environment, a snapshot may be created. As mentioned above, the attack target simulated environment is at least one of the target simulated environments 310a to 310n included in the record stored in step S802 of the overall processing, and is an environment that can be attacked by a specific threat that can be identified by a hunting query.

Next, the log analysis query creation support device 100 stores and memorizes the current log of the attack target simulated environment in the log table 410 of the log management device 400 (step S1002). Specifically, in the process described below, the current log of the attack target simulated environment is stored in the log table 410 to understand the difference in log status depending on whether or not there is an attack related to a hunting query. This current log includes event logs such as sysmon logs, and static information such as file and registry information. Note that this log is an example, and the present invention is not limited to this type.

Next, the log analysis query creation support device 100 obtains, via the Internet, multiple specimens related to specific threats that can be identified by the hunting query and information on manual threat attack methods related to the hunting query (step S1003). Specifically, if the specific threat that can be identified by the hunting query is an automatically executed threat such as malware, specimens such as malware are obtained. Furthermore, if the specific threat that can be identified by the hunting query is a manually executed threat, information on manual threat attack methods related to the hunting query is obtained. Here, specimen lists of the specified threat type and information on specific threat attack methods are obtained from personal blogs that publish lists of malware families and malware specimens, vendor reports, and data sharing devices 600a-600n that store web services. In other words, the log analysis query creation support device 100 obtains information on the execution procedures for attacks on the target environment by multiple specific threats from at least one data sharing device 600a-600n that stores information on the execution procedures for attacks on the target environment by multiple specific threats.

For example, if the specific threat is malware, one or more samples are obtained from a malware sharing service based on the sample list. While it is desirable to obtain multiple samples and information on threat attack methods, one sample is sufficient. In many cases, multiple samples and information on specific threat attack methods can be obtained.

Next, the log analysis query creation support device 100 determines whether an attack on the threat of the hunting query can be executed automatically based on the threat category information included in the input information (step S1004). If the threat category of the hunting query is malware and it is determined that an attack on the threat of the hunting query can be executed automatically (step S1004: YES), the process proceeds to step S1006. On the other hand, if the threat category of the hunting query is not malware and it is determined that an attack on the threat of the hunting query cannot be executed automatically (step S1004: NO), the process proceeds to step S1205, where manual attack execution processing is executed.

If it is determined that an attack on a hunting query threat can be executed automatically (step S1004: YES), the attack on the hunting query is executed automatically from step S1006 onwards. On the other hand, if it is determined that an attack on a hunting query threat cannot be executed automatically (step S1004: NO), the attack on the hunting query cannot be executed automatically and must be executed manually, so the process proceeds to step S1205, where the attack on the hunting query is executed manually. Furthermore, even if the threat category of the hunting query is malware, the analyst may set criteria for determining whether an attack on a hunting query threat can be executed automatically, so that the process proceeds to step S1205 and the attack on the hunting query is executed manually.

Next, the log analysis query creation support device 100 executes a manual attack execution process (step S1005), details of which will be described later using FIG. 11. In step S10005, the log analysis query creation support device 100 executes an attack related to a hunting query by an analyst against the attack target simulated environment of the target simulated environment devices 300a-300n that were backed up in step S1001, and acquires the log of the attack execution.

Next, the log analysis query creation support device 100 starts loop processing for the malware sample acquired in step 1003 (step S1006). The processing shown between step S1006, which starts the loop, and step S1010, which ends the loop, is repeated for each malware sample acquired in step 1003. In step S1006, the log analysis query creation support device 100 selects one malware sample from the unprocessed malware samples.

Next, the log analysis query creation support device 100 executes an attack using the malware sample selected in step S1006 on each of the target simulated environments of the target simulated environment devices 300a-300n backed up in step S1001, acquires a log of this attack execution, and stores and remembers it in the log table 410 (step S1007).

Next, the log analysis query creation support device 100 saves information about each attack executed in step S1007 in the attack information table 123 (step S1008). Specifically, for each attack, the log analysis query creation support device 100 saves a record in the attack information table 123, including: a unique new ID in attack ID 501; the query ID 301 in query management table 121 corresponding to query ID 502; the threat type of the executed sample or the malware hash value in attack name 503; the URL from which the sample was obtained in step S1003 in attack information source 504; the identifier of the corresponding environment ID 401 in simulated environment table 122 in environment ID 505; the time the attack started in attack start time 506; and the time the attack ended in attack end time 507.

Next, the log analysis query creation support device 100 restores each of the attack target simulated environments of the target simulated environment devices 300a to 300n, which were backed up in step S1001, to the state of the backup taken in step S1001 (step S1009).

Next, the log analysis query creation support device 100 determines whether processing has been completed for all malware samples acquired in step 1003 (step S1010). If it is determined that processing has not been completed for all malware samples, the log analysis query creation support device 100 returns to step S1006 and continues processing. On the other hand, if it is determined that processing has been completed for all malware samples, the log analysis query creation support device 100 proceeds to step S1011.

Next, the log analysis query creation support device 100 calculates and stores the action commonality, environment selectivity, and accuracy based on information about each attack executed in step S1007 or information about each manual attack acquired in step S1102 of the manual attack execution process described below using Figure 11, and saves these in the query management table together with the information acquisition ease calculated in step S903 of the information acquisition ease calculation process in Figure 9, and terminates the process (step S1011).

As described above, behavioral commonality represents the degree to which a hunting query can detect common attack procedures among the detection results for multiple specific threats when the impact of attacks by multiple specific threats (e.g., samples of a malware family, patterns of a specific attacker in a manual attack) on the analysis target environment 510a-510n (target environment) is detected by searching the execution logs using a hunting query. The higher the behavioral commonality of a query, the more similar types of threats the hunting query can detect. For example, if a hunting query is used to search the logs of the execution results of n similar samples or manual attacks (n logs) and m threats are detected, the behavioral commonality is calculated as m/n (behavioral commonality = m/n). In the present invention, other methods of calculating behavioral commonality may also be used.

As described above, environment selectivity represents the number of different target environments in which threats can be detected when a hunting query is used to detect the impact of attacks by multiple specific threats (e.g., a malware family specimen, or a specific attacker's pattern in a manual attack) on analysis target environments 510a-510n (attack target environments) in the execution logs of those attacks. The higher the environment selectivity, the more types of environments attacks by threats can be detected by the hunting query. For example, if one specimen or one type of manual attack is used to attack n types of simulated environments, and the logs from the execution of each attack are searched using a query to detect threats m times, the environment selectivity is calculated as m/n (environment selectivity = m/n). Other methods for calculating environment selectivity are also possible in the present invention.

As described above, accuracy indicates how accurately the impact of a specific threat attack can be detected when the impact of each specific threat identified by a hunting query is detected by searching the execution logs with the hunting query when the execution logs are used to detect the impact of the specific threat attack on the target environment. The higher the accuracy of a hunting query, the more accurately the hunting query can detect threats from the execution result logs. For example, if one sample or one type of manual attack is used to perform n separate attacks on a simulated environment, and the execution logs for each attack are searched and detected m times with a query, the accuracy is calculated as m/n (accuracy = m/n). In the present invention, other methods of calculating accuracy may also be used.

<Manual attack execution process, Figure 11>
11 is a flowchart illustrating an example of a manual attack execution process executed by the log analysis query creation support device 100 according to the embodiment. The manual attack execution process illustrated in FIG. 11 is executed by the query threat impact calculation unit 113 of the log analysis query creation support device 100.

The log analysis query creation support device 100 starts loop processing for the information on manual attack execution methods acquired in step 1003 of the query threat impact calculation process in FIG. 10 (step S1101). The processing shown between step S1101, which starts the loop, and step S1105, which ends the loop, is repeated for each piece of manual attack execution method information acquired in step 1003 of the attack execution process in FIG. 10 described above. In step S1101, the log analysis query creation support device 100 selects one piece of manual attack execution method information from the unprocessed manual attack execution method information and presents it to the analyst. When presented with the manual attack execution method information, the analyst executes the manual attack based on the presented manual attack execution method information. The manual attack is executed using, for example, a red team tool. The present invention is not dependent on the method of executing the manual attack.

Next, the log analysis query creation support device 100 waits for the analyst to execute a manual attack on each of the attack target simulated environments, acquires the execution log of this manual attack, and stores and memorizes it in the log table 410 (step S1102).

Next, the log analysis query creation support device 100 saves information about each manual attack acquired in step S1102 in the attack information table 123 (step S1103). Specifically, for each attack, the log analysis query creation support device 100 saves a record in the attack information table 123, including: a unique new ID in attack ID 501; the query ID 301 in the query management table 121 corresponding to query ID 502; information about the execution method of the threat executed in attack name 503; the URL from which the sample was acquired in step S1003 in attack information source 504; the identifier of the corresponding environment ID 401 in the simulated environment table 122 in environment ID 505; the time the attack started in attack start time 506; and the time the attack ended in attack end time 507.

Next, the log analysis query creation support device 100 restores each of the attack target simulated environments of the target simulated environment devices 300a to 300n, which were backed up in step S1001 of the query threat impact calculation process in FIG. 10, to the state of the backup taken in step S1001 (step S1104).

Next, the log analysis query creation support device 100 determines whether processing has been completed for all information on manual attack execution methods acquired in step S1003 of the query threat impact calculation process in FIG. 10 (step S1105). If it is determined that processing has not been completed for all information on manual attack execution methods, the log analysis query creation support device 100 returns to step S1101 and continues processing. On the other hand, if it is determined that processing has been completed for all information on manual attack execution methods, the log analysis query creation support device 100 terminates processing.

<Query Effectiveness Calculation Process, FIG. 12>
12 is a flowchart illustrating an example of a query validity calculation process executed by the log analysis query creation support device 100 according to the embodiment. The query validity calculation process illustrated in FIG. 12 is executed by the query validity calculation unit 114 of the log analysis query creation support device 100.

The log analysis query creation support device 100 extracts records from the validity table 124 that match the threat category and type of the input information (i.e., records that correspond to the hunting query) (step S1201).

Next, the log analysis query creation support device 100 calculates the effectiveness by applying the information acquisition ease calculated in step S903 of the information acquisition ease calculation process of FIG. 9 and the behavior commonality, environment selectivity, and accuracy calculated in step S1011 of the query threat impact calculation process of FIG. 10 to the effectiveness calculation formula for the record extracted in step S1201, and further calculates the effectiveness determination value (step S1202). Here, the effectiveness determination value indicates whether the hunting query is effective or not. If the effectiveness threshold of the record extracted in step S1201 is greater than the calculated effectiveness, the log analysis query creation support device 100 calculates the effectiveness determination value as "effective," and if the record's effectiveness threshold is less than the calculated effectiveness, the log analysis query creation support device 100 calculates the effectiveness determination value as "ineffective."

Next, the log analysis query creation support device 100 outputs output information regarding the validity of the hunting query, transmits it to the analyst terminal 200, and terminates the process (step S1503). Here, the output information regarding the validity of the hunting query includes information regarding the validity, the validity judgment value, the ease of information acquisition, information regarding the query verification results including information calculated in the query threat impact calculation process, and information indicating that this information will be added and displayed on the analysis screen (see analysis screen 700 in FIG. 7). Upon receiving the output information, the analyst terminal 200 adds and displays, on the analysis screen (see analysis screen 700 in FIG. 7), information regarding the validity of the hunting query, including the received information regarding the validity judgment value, the ease of information acquisition, and the query verification results.

Furthermore, when the analyst presses the query execution button 730 on the analysis screen (see analysis screen 700 in Figure 7) displayed on the analyst terminal 200, the analyst terminal 200 transmits information to the log analysis query creation support device 100 indicating that the logs of the analysis target devices 500a to 500n will be analyzed using a hunting query.

When the log analysis query creation support device 100 receives from the analyst terminal 200 information indicating that the logs of the analysis target devices 500a-500n will be analyzed using a hunting query, the log analysis execution unit 115 of the log analysis query creation support device 100 analyzes the logs of the analysis target devices 500a-500n using the hunting query. That is, the log analysis execution unit 115 accesses the log management device 400 to acquire the logs of the analysis target devices 500a-500n, searches the acquired logs using the hunting query, and detects the impact of a specific threat from the acquired logs. The log analysis execution unit 115 then stores "executed" in the execution status 310 field of the record corresponding to the hunting query in the query management table 121, and stores information on the number of detected threat impacts, which is the execution result, in the execution result hit count 311.

Here, if the log analysis execution unit 115 detects the impact of a specific threat, it sends a notice to the analyst terminal 200 that an alert will be presented, causing the analyst terminal 200 to present the alert. The method of presenting the alert may be a method of presenting warning information on the analysis screen 700, a method of sending an email containing the warning information, or any other method that can present the alert to the analyst. Also, as described above, the log analysis execution unit 115 uses a hunting query to search the execution logs of the inspection target (logs of the analysis target devices 500a to 500n) created in the target environment, and inspects information related to the threat (detects the impact of the specific threat).

<<Effects of the Invention>>
In this way, the log analysis query creation support device 100 calculates the ease of information acquisition, accuracy, and behavior commonality for a hunting query. Furthermore, based on the ease of information acquisition, accuracy, and behavior commonality, it is possible to determine whether the effectiveness of a hunting query is high. If it is determined that the effectiveness of a hunting query is high, it can be considered that the hunting query is a hunting query that preferably includes information on the characteristics of an anticipated threat. This makes it easy for the log analysis query creation support device 100 to determine whether a hunting query is a highly effective hunting query that preferably includes information on the characteristics of an anticipated threat. Ultimately, the log analysis query creation support device 100 makes it easy to determine the effectiveness of a hunting query.

The log analysis query creation support device 100 also facilitates system analysis through threat hunting, which detects threats such as malware and crackers that have invaded the system and cannot be prevented by security devices (such as firewalls) or security software, from the system status log. As a result, it is possible to prevent business interruptions due to system malfunctions and loss of credibility due to data leaks.

Furthermore, the log analysis query creation support device 100 can reduce the energy required to respond to system malfunctions and the amount of carbon dioxide emissions generated, thereby curbing global warming.

The log analysis query creation support device 100 also calculates the effectiveness of a hunting query, which indicates the effectiveness of the hunting query. This makes it easier for analysts to determine whether a hunting query is highly effective and appropriately includes information on the characteristics of the anticipated threat. Therefore, the log analysis query creation support device 100 can easily determine the effectiveness of a hunting query.

The log analysis query creation support device 100 also outputs a validity determination value indicating whether a hunting query is valid. This makes it easier for analysts to determine whether a hunting query is highly effective and appropriately includes information on the characteristics of anticipated threats.

Furthermore, when the effectiveness is higher than the effectiveness threshold, the log analysis query creation support device 100 searches the execution logs to be inspected that were created in the target environment using a hunting query to inspect information related to threats. This makes it easy to search the execution logs to be inspected that were created in the target environment using a hunting query to inspect information related to threats.

The log analysis query creation support device 100 can also acquire information about the execution procedures for attacks on a target environment by multiple specific threats via a network. This allows the log analysis query creation support device 100 to more reliably execute attacks on a target environment by multiple specific threats, search the execution logs using a hunting query, and investigate the impact of multiple specific threats on a target environment.

Furthermore, when a malware sample can be identified using a hunting query, the log analysis query creation support device 100 automatically executes attacks on the target environment using multiple specific threats, searches the execution log using the hunting query, and automatically investigates the impact of the multiple specific threats on the target environment. This allows the log analysis query creation support device 100 to more easily investigate the impact on the target environment of multiple specific threats that can be detected using a hunting query.

Furthermore, when information on the execution procedures of manually executed threats can be obtained using a hunting query, the log analysis query creation support device 100 acquires execution logs of attacks on the target environment by multiple manually executed specific threats, detects the impact of the attacks by the multiple specific threats in the acquired execution logs using a hunting query, and calculates accuracy and commonality of behavior based on the detection results. This makes it easier to investigate the impact on the target environment of multiple specific threats that can be detected using a hunting query.

The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the spirit of the appended claims. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to configurations that include all of the described configurations. Furthermore, part of the configuration of one embodiment may be replaced with the configuration of another embodiment. Furthermore, the configuration of another embodiment may be added to the configuration of one embodiment. Furthermore, part of the configuration of each embodiment may be added to, deleted from, or replaced with other configurations.

1: Log analysis system 100: Log analysis query creation support device 101: Processor 102: Main memory device 103: Sub-memory device 104: NWIF
105: Input/output device 106: Bus 111: Processing execution unit 111a: Processing execution program 112: Information acquisition ease calculation unit 112a: Information acquisition ease calculation program 113: Query threat impact calculation unit 113a: Query threat impact calculation program 114: Query validity calculation unit 114a: Query validity calculation program 115: Log analysis execution unit 115a: Log analysis execution program 121: Query management table 122: Simulated environment table 123: Attack information table 124: Effectiveness table 200: Analyst terminal 300a to 300n: Target simulated environment device 310a to 310n: Target simulated environment 400: Log management device 410: Log tables 500a to 500n: Analysis target device 510a to 510n: Analysis target environment 600a to 600n: Data sharing devices NW1, NW2: Network

Claims (8)

A log analysis query creation support device to which a hunting query used to detect the impact of a threat on a target environment from a log is input, comprising:
an information acquisition ease calculation unit that calculates an information acquisition ease indicating the ease of collecting query-related articles that are highly relevant to information on attacks of a specific threat that can be identified by the hunting query;
a query threat impact calculation unit that calculates an accuracy indicating how accurately the impact of an attack by a specific threat can be detected when the hunting query is used to search the execution logs to detect the impact of the attack by each of the multiple specific threats when the hunting query is used to search the execution logs to detect the impact of the attack by the specific threats when the hunting query is used to search the execution logs to detect the impact of the attack by the multiple ...
a query effectiveness calculation unit that calculates an effectiveness indicating the effectiveness of the hunting query based on the information acquisition ease, the accuracy, and the operation commonality;
Log analysis query creation support device. 2. The log analysis query creation support device according to claim 1 ,
The query effectiveness calculation unit further outputs an effectiveness determination value indicating whether the hunting query is effective or not based on the effectiveness.
Log analysis query creation support device. 2. The log analysis query creation support device according to claim 1 ,
The log analysis query creation support device further includes a log analysis execution unit that searches the execution log to be inspected, which is created in the target environment, using the hunting query to inspect information related to threats. 2. The log analysis query creation support device according to claim 1,
Furthermore, the system is connected to a network that is connected to at least one data sharing device that stores information on execution procedures for attacks on the target environment by the plurality of specific threats,
the query threat impact calculation unit acquires information on execution procedures of attacks on the target environment by the plurality of specific threats via the network;
Executing an attack on the target environment by the plurality of specific threats using the acquired information on the execution procedure of an attack on the target environment by the plurality of specific threats.
Log analysis query creation support device. 5. The log analysis query creation support device according to claim 4 ,
When the information on the execution procedures of attacks on the target environment by the plurality of specific threats is a malware sample, the query threat impact calculation unit:
using information on the execution procedures of attacks on the target environment by the plurality of specific threats that are samples of the malware, to execute the attacks on the target environment and acquire an execution log;
Detecting the impact of the attack of the specific threat in the acquired execution log using the hunting query, and calculating the accuracy and the behavior commonality based on the detection result.
Log analysis query creation support device. 5. The log analysis query creation support device according to claim 4 ,
When the information on the execution procedure of an attack on the target environment by the specific threat is information on the execution procedure of a threat that is executed manually, the query threat impact calculation unit:
outputting information on the execution procedures of attacks on the target environment by the plurality of specific threats;
acquiring an execution log of attacks by the plurality of specific threats on the target environment;
Detecting the effects of attacks of the plurality of specific threats in the acquired execution logs using the hunting query, and calculating the accuracy and the behavior commonality based on the detection results.
Log analysis query creation support device. 1. A log analysis query creation support method for receiving a hunting query used to detect an impact of a threat on a target environment from a log and causing a processor in a log analysis query creation support device to execute the hunting query, the method comprising:
Calculating an information acquisition ease indicating the ease of collecting query-related articles that are highly relevant to the hunting query;
calculate an accuracy indicating how accurately the impact of an attack by a specific threat can be detected when the hunting query is used to search the execution logs to detect the impact of the attack by each of the multiple specific threats when the hunting query searches the execution logs to detect the impact of the attack by the specific threat, and calculate an operation commonality indicating how accurately the hunting query can detect common attack procedures between detection results for the multiple specific threats when the hunting query is used to search the execution logs to detect the impact of the attack by ...
calculating an effectiveness indicating the effectiveness of the hunting query based on the information acquisition ease, the accuracy, and the action commonality;
A method for assisting in creating log analysis queries. A log analysis query creation support program for inputting a hunting query used to detect the impact of a threat on a target environment from a log and for executing the program on a processor of a log analysis query creation support device having a processor, the program comprising:
Log analysis query creation support program
Calculating an information acquisition ease indicating the ease of collecting query-related articles that are highly relevant to the hunting query;
calculate an accuracy indicating how accurately the impact of an attack by a specific threat can be detected when the hunting query is used to search the execution logs to detect the impact of the attack by each of the multiple specific threats when the hunting query searches the execution logs to detect the impact of the attack by the specific threat, and calculate an operation commonality indicating how accurately the hunting query can detect common attack procedures between detection results for the multiple specific threats when the hunting query is used to search the execution logs to detect the impact of the attack by ...
calculating an effectiveness indicating the effectiveness of the hunting query based on the information acquisition ease, the accuracy, and the action commonality;
A program to assist in creating log analysis queries.