JP7808014B2 - Cyber attack response support system, cyber attack response support method, and cyber attack response support program - Google Patents

Description

The present invention relates to technology that supports responses to cyber attacks in systems that include information devices.

For example, computer systems in the industrial sector (industrial control systems) are composed of highly reliable information devices specialized for specific control processes, including PLCs (Programmable Logic Controllers) and HMIs (Human Machine Interfaces). Industrial control systems play an important role in monitoring and controlling social infrastructure such as electricity, railways, water, and gas, as well as production equipment in factories and plants. For this reason, it is important for industrial control systems to continue operating stably (availability) even when abnormal situations occur.

Industrial control systems have traditionally operated in environments isolated from the outside world. However, with advances in IoT (Internet of Things) technology in recent years, there has been an increasing trend for systems to be connected to external networks such as the Internet. While connecting to external networks has improved productivity and convenience, it has also significantly increased the risk of cyberattacks. Because the impact on society would be significant if an industrial control system were to cease operation, it can become the target of Advanced Persistent Threat (APT) attacks, which are highly sophisticated, continuous attacks on clearly defined targets. While implementing sufficient security measures to minimize damage is essential, APT attacks often involve zero-day exploits, making it difficult to completely eliminate the risk of an attack occurring. Therefore, in order to reduce security risks, it is important to establish an organizational structure that can quickly implement countermeasures to minimize the impact on systems, even if an attack does occur.

In general information systems, an effective way to improve an organization's response capabilities is to deploy both an attacker group, composed of experts who imitate attackers and launch attacks, and a defender group, composed of experts (including the organization's security personnel) who thwart attacks, and to improve the defender group's decision-making and response capabilities through practical exercises involving both groups. It is recommended that the attacker group repeat practical exercises, imitating attacker profiles consisting of multiple attack objectives and methods, based on actual APT attack cases. The defender group may also change their defender profile, composed of defensive objectives and methods, depending on the situation, and repeat training under different conditions. In the cybersecurity field, the attacker group is called the red team and the defender group is called the blue team. Strengthening the organizational structure for responding to cyber attacks through joint practical exercises involving both teams is sometimes called purple teaming.

However, unlike general information systems, availability is considered important in industrial control systems, so practical exercises that could affect availability are often not permitted to be conducted on actual systems. Furthermore, industrial control systems require not only advanced security knowledge, but also the development of countermeasures that take into account special system operations where availability is important, so there is a shortage of experts. For these reasons, defender groups often lack training, which can delay decision-making and response implementation when a cyberattack occurs, potentially leading to increased damage.

For example, Patent Document 1 discloses technology that, when a cyberattack is detected, presents the most appropriate countermeasure from among multiple predefined countermeasure templates, taking into account the impact the countermeasure will have on the system's operations.

JP 2018-137500 A

Using the technology disclosed in Patent Document 1, when a cyberattack is detected, it is possible to automate decision-making and support for implementing countermeasures from the perspective of a defender group. However, because this is a countermeasure from the defender's perspective, it is not necessarily appropriate, and it is not possible to present countermeasures that anticipate the attacker's actions.

The present invention was developed in light of the above circumstances, and its purpose is to provide technology that enables the design of appropriate countermeasures against cyber attacks.

To achieve the above objective, one aspect of the cyber attack response support system is a cyber attack response support system that designs countermeasures against cyber attacks on a specified target system, and includes a memory unit that stores one or more attacker profiles that include the attack objectives and attack methods of attackers who carry out cyber attacks, and one or more defender profiles that include the defense objectives and defense methods of defenders who defend against cyber attacks, and a countermeasure design unit that reproduces the state of the target system and uses a system model that outputs index values of one or more indicators that indicate the performance of the target system corresponding to the state of the target system to design countermeasures for each combination of the attacker profile and the defender profile.

This invention makes it possible to design appropriate countermeasures against cyber attacks.

FIG. 1 is a functional block diagram of a cyber-attack response support system according to the first embodiment. FIG. 2 is a diagram illustrating a system model according to the first embodiment. FIG. 3 is a diagram illustrating the time series transition of production volume according to the first embodiment. FIG. 4 is a diagram showing the configuration of an attacker profile according to the first embodiment. FIG. 5 is a diagram showing the configuration of a defender profile according to the first embodiment. FIG. 6 is a flowchart of the countermeasure design process according to the first embodiment. FIG. 7 is a diagram showing the system configuration of a system model that reflects abnormality detection information according to the first embodiment. FIG. 8 is a diagram illustrating prediction of an attacker's behavior with respect to the system model according to the first embodiment. FIG. 9 is a diagram illustrating the prediction of the defender's behavior with respect to the system model according to the first embodiment. FIG. 10 is a diagram showing the configuration of a list of countermeasures according to the first embodiment. FIG. 11 is a configuration diagram of statistical information of countermeasures according to the first embodiment. FIG. 12 is a diagram illustrating the configuration of information indicating the relationship between the observed behavior of an attacker and a match with an attacker profile according to the first embodiment. FIG. 13 is a functional block diagram of a cyber-attack response support system according to the second embodiment. FIG. 14 is a diagram showing the configuration of an output table of countermeasures according to the second embodiment. FIG. 15 is a functional block diagram of a cyber-attack response support system according to the third embodiment. FIG. 16 is a diagram illustrating a defender model according to the third embodiment. FIG. 17 is a flowchart of the defender model generation process according to the third embodiment.

Embodiments will be described with reference to the drawings. Note that the embodiments described below do not limit the invention as defined in the claims, and not all of the elements and combinations thereof described in the embodiments are necessarily essential to the solution of the invention.

(First embodiment)
FIG. 1 is a functional block diagram of a cyber-attack response support system according to the first embodiment.

The cyber-attack response support system 1000 includes a cyber-attack response support device 10, an anomaly detection system 11, an input/output device 12, and an industrial control system 13.

The cyber-attack response support device 10 is configured, for example, as a computer equipped with a processor, memory, storage device, etc., and has a processing unit 110 and a storage unit 120.

The processing unit 110 is a functional unit realized by the processor executing a program (cyber-attack response support program) deployed in memory. The processing unit 110 includes a countermeasure design unit 111, a countermeasure selection unit 112 (an example of a reception unit and display unit), and a countermeasure execution unit 113.

The memory unit 120 is composed of a storage device that stores data. The storage device may be, for example, a memory such as RAM (Random Access Memory), a HDD (Hard Disk Drive), or an SSD (Solid State Drive). The memory unit 120 may also be constructed using an external storage medium such as an HDD or SSD that is independent of the cyber-attack response support device 10. The memory unit 120 stores a system model 121, one or more attacker profiles 122, and one or more defender profiles 123.

The anomaly detection system 11 is a system that detects anomalies in the industrial control system 13 (target system), and is composed of an NIDS (Network-based Intrusion Detection System), which detects signs of attack by monitoring network communications in real time, and an HIDS (Host-based Intrusion Detection System), which detects signs of attack using software running on a computer. When the anomaly detection system 11 detects an anomaly in the target system, it notifies the countermeasure design unit 111 of the cyber-attack response support device 10 of anomaly detection information including the location of the anomaly, the content of the anomaly, etc.

The input/output device 12 is a device that allows the user to interactively input and output data to the cyber-attack response support device 10, and is composed of a keyboard, mouse, display, etc.

The industrial control system 13 includes multiple information devices 130, robots (not shown) controlled by the information devices 130, etc. The multiple information devices 130 include computer devices such as PLCs and HMIs, and network devices such as switches and firewalls that connect and disconnect networks between computer devices.

Next, the processing unit 110 and memory unit 120 will be described in detail.

When the countermeasure design unit 111 receives anomaly detection information for the target system transmitted from the anomaly detection system 11, it starts operation, reads the system model 121, attacker profile 122, and defender profile 123 from the storage unit 120, and executes processing to design countermeasures for the industrial control system 13. The countermeasure selection unit 112 displays information about the designed countermeasures (countermeasure information) on the input/output device 12, and accepts designation of the countermeasures to be applied from the user via the input/output device 12. The countermeasure execution unit 113 applies the countermeasures accepted by the countermeasure selection unit 112 to the industrial control system 13 and executes them.

The system model 121 is a model that includes configuration information of information devices in the target system and can reproduce the target system when executed by the processing unit 110. The system model 121 also has a calculation function that quantifies the performance of the target system using one or more indices depending on the state of the information devices. Here, the configuration information includes, for example, information on the information device's hardware, software, vulnerability information, logical configuration, physical configuration, and dependency information between information devices required for the information devices to operate normally. The configuration information also has attributes that represent the state of the information devices, and it is possible to reflect anomaly detection information detected by the anomaly detection system 11 in the information devices.

Next, we will explain the calculation functions of the system model 121.

Figure 2 is a diagram illustrating the system model according to the first embodiment.

When status information 21 of information equipment 130 is input, system model 121 (strictly speaking, processing unit 110 using system model 121) outputs performance 23 of the target system quantified using one or more indices. For example, status information 21 indicates that information equipment identified as PLC1 is in normal operation, information equipment identified as PLC2 is in a DoS (Denial of Service) state, and information equipment identified as HMI is in a state where the equipment's operating mode has been changed. In this case, system model 121 outputs, for example, indices representing the performance of the target system and their values: production volume 50%, confidentiality protection rate 20%, and safety risk avoidance rate 80%. Here, the safety risk avoidance rate indicates the rate at which states that pose a risk to safety are avoided.

The system model 121 may, for example, calculate the percentage of information devices in a normal operating state as the production volume. For example, if there are 100 information devices operating in the target system and 50 of them are in a normal operating state, the production volume may be calculated as 50%. In this example, the system model 121 calculates a unique production volume based only on the status information 21 of the information devices at a certain time, regardless of the time series changes in the status of the information devices. However, this is not limited to this, and the production volume may also be calculated taking into account, for example, the historical effect related to the time series changes in the status of the information devices.

Next, we will show an example of calculating production volume taking into account the time series changes in the information device status information 21.

Figure 3 is a diagram illustrating the time series of production volume in the first embodiment. In Figure 3, the horizontal axis represents time, and the vertical axis represents production volume. The example in Figure 3 shows a case where all information devices are in a normal operating state from time 0 to t1, half of the information devices are in a normal operating state from time t1 to t2, and all information devices are in a normal operating state from time t2 onwards. In this example, production volume is 100% until time t1, decreases continuously from time t1 to t2, and then recovers continuously from time t2 onwards.

In addition, the system model 121 may calculate the confidentiality protection rate, for example, by setting a confidentiality protection score for each information device 130 in the industrial control system 13, and calculating the ratio of the total scores of information devices 130 for which confidentiality protection is ensured to the total scores of all information devices 130.

In addition, the system model 121 may calculate the safety risk aversion rate, for example, by setting a safety risk score for each information device 130 in the industrial control system 13, and calculating the ratio of the total scores of information devices 130 for which safety risks have been averted to the total scores of all information devices 130.

Calculations performed by the calculation function of the system model 121 are not limited to the above example, and can be any calculation that inputs information about the status of the information device 21 and outputs the performance 23 of the target system quantified using one or more types of indicators, and another indicator may be used to calculate a certain indicator.

Next, we will explain the attacker profile 122.

Figure 4 is a diagram showing the configuration of an attacker profile in the first embodiment.

The attacker profile 122 is information that defines the type of attacker that is anticipated. The attacker profile 122 is stored in the memory unit 120. In this embodiment, the memory unit 120 stores multiple (Ni) patterns of attacker profile 122.

The attacker profile 122 includes an identifier, an identification name, an attack purpose, and an attack method. The attacker profile 122 may also include identification information for APT groups with similar attack purposes and attack methods.

The identifier defines information that can uniquely identify the attacker profile 122. For example, an integer value from 1 to Ni is assigned to the identifier. The identifier defines a name that identifies the attacker profile 122. Note that in this embodiment, the identifier also uniquely identifies the attacker profile 122.

Attack methods define specific attack methods that attackers can use, such as DoS and changing control parameters.

The attack objective defines the percentage (target value) of one or more indicators (attack objective indicators) that are important when carrying out an attack. This means that the attacker's goal is to maximize the change in this indicator. For example, in attacker profile 122-1, whose identifier is production volume-specialized, the attack objective is defined as "production volume (100%)", meaning that the attack objective is solely aimed at affecting production volume. This means that the attacker in attacker profile 122-1 does not aim to affect other indicators such as confidentiality protection rate or safety risk avoidance rate.

Furthermore, in attacker profile 122-2, whose identification name is Balanced, the attack objective is defined as "production volume (30%), confidentiality protection rate (40%), safety risk avoidance rate (30%)," which means that the objective is to affect production volume, confidentiality protection rate, and safety risk avoidance rate in a ratio of 3:4:3.

As an example of how to calculate the impact on the target system, taking the impact of production volume as an example, if production volume changes as shown in Figure 3, the cumulative amount represented by the area of the shaded area in the figure can be used as the impact on production volume, or the maximum instantaneous change can be used.

Hereinafter, the influence of production volume, confidentiality protection rate, and safety risk aversion rate will be represented as X, Y, and Z. In the case of the production volume-specialized attacker profile 122-1, the objective is to maximize 1X, and in the case of the balanced attacker profile 122-2, the objective is to maximize 0.3X + 0.4Y + 0.3Z.

Next, we will explain the defender profile 123.

Figure 5 is a diagram showing the configuration of a defender profile in the first embodiment.

The defender profile 123 is information that defines the type of defender that is expected. The defender profile 123 is stored in the memory unit 120. In this embodiment, the memory unit 120 stores multiple (Nj) patterns of defender profiles 123.

The defender profile 123 includes an identifier, an identification name, a defense purpose, and a defense method.

The identifier defines information that can uniquely identify the defender profile 123. For example, an integer value from 1 to Nj is assigned to the identifier. The identification name defines a name that identifies the defender profile 123. Note that in this embodiment, the identification name can also uniquely identify the defender profile 123.

Defensive methods define specific defensive techniques that defenders can use, such as changing the device's operating mode or shutting down the device.

A defense objective defines the percentage (target value) of one or more indicators (defense objective indicators) that are important when implementing defense. This means that the defender's objective is to minimize changes in this indicator. For example, in a defender profile 123-1 with the identification name "Safety Risk Avoidance Rate Specialized," the defense objective is defined as "Safety Risk Avoidance Rate (100%)," and therefore the defender of defender profile 123-1 aims to minimize 1Z.

Furthermore, in the defender profile 123-2, whose identifier is confidentiality protection rate-focused, the defense objectives are defined as "production volume (10%), confidentiality protection rate (70%), safety risk avoidance rate (20%)," and the objective is to minimize 0.1X + 0.7Y + 0.2Z.

Here, if the attack objective of the attacker profile 122 and the defense objective of the defender profile 123 are the same, it means that they are trying to achieve completely opposite objectives. Note that it is not necessary for the attack objective of the attacker profile 122 and the defense objective of the defender profile 123 to be the same.

Next, we will explain the processing operations of the cyber-attack response support device 10.

Figure 6 is a flowchart of the countermeasure design process according to the first embodiment.

The countermeasure design process is executed when the countermeasure design unit 111 of the cyber-attack response support device 10 receives anomaly detection information about the target system (industrial control system 13) from the anomaly detection system 11.

The countermeasure design unit 111 reads the system model 121 from the memory unit 120 and reflects the state corresponding to the received abnormality detection information in the system model 121 (S61).

Here, Figure 7 is a diagram showing the system configuration of a system model that reflects anomaly detection information according to the first embodiment. In Figure 7, the industrial control system 13 includes, as information devices 130, a monitoring terminal connected via a network, control server 1, control server 2, PLC1, PLC2, and an HMI, and the anomaly detection information includes information that an abnormal intrusion has been detected at the monitoring terminal.

In step S61, as shown in FIG. 7, the attribute representing the state of the monitoring terminal in the system model 121 is set to "unauthorized intrusion."

Returning to the explanation of Figure 6, the countermeasure design unit 111 defines integer variables i and j and sets their values to 1 (S62).

Next, the countermeasure design unit 111 reads the attacker profile 122 with identifier i and the defender profile 123 with identifier j from the storage unit 120 (S63).

The countermeasure design unit 111 then uses the system model 121 to predict the attacker's behavior based on the loaded attacker profile 122. Note that the attacker's objectives and methods of attack differ depending on the loaded attacker profile 122, and therefore the attacker's behavior changes.

Figure 8 is a diagram illustrating the prediction of attacker behavior for the system model in the first embodiment.

For example, the attacker's behavior predicted from the production volume-specialized attacker profile 122-1 is that an attacker who has illegally accessed a monitoring terminal will then attack control server 1 using the "control parameter change" attack method, and finally attack PLC 1 using the "DoS" attack method. The attack method is selected from the attack methods defined in attacker profile 122-1. Furthermore, the attacker's behavior is derived to maximize the impact on the target system, represented by 1X, which corresponds to the purpose of the attack.

Furthermore, the attacker's behavior predicted from the balanced attacker profile 122-2 is, for example, that an attacker who has illegally accessed a monitoring terminal will then attack the control server 2 using the "control tag information collection" attack method, and finally attack the HMI using the "alarm setting change" attack method. This attacker's behavior is derived to maximize the impact on the target system, which is expressed as 0.3X + 0.4Y + 0.3Z, corresponding to the attack objective.

Returning to the explanation of Figure 6, the countermeasure design unit 111 uses the system model 121 to derive optimal countermeasures based on the attacker's behavior and the defender profile 123 (S63).

Figure 9 is a diagram illustrating the prediction of defender behavior for the system model in the first embodiment.

For example, the defender's behavior predicted from the safety risk aversion rate-specialized defender profile 123-1 is that the optimal countermeasure is to defend against PLC1 using the "stop equipment" defensive method. The defensive method is selected from the defensive methods in the defender profile 123-1. Furthermore, this defender's behavior is derived to minimize the impact on the target system, represented by 1Z, which corresponds to the defensive objective.

Furthermore, the defender's behavior predicted from the confidentiality protection rate-focused defender profile 123-2 is that the optimal countermeasure would be to defend against the control server 1 using the defensive technique of "changing access control settings." This defender's behavior is derived to minimize the impact on the target system, which corresponds to the defensive objective and is expressed as 0.1X + 0.7Y + 0.2Z.

Returning to the explanation of Figure 6, the countermeasure design unit 111 compares the variable i with Ni and determines whether the variable i is less than Ni (S66). As a result, if the variable i is less than Ni (S66: Y), this means that countermeasures have not been derived for all attacker profiles 122 for one defender profile 123, so the countermeasure design unit 111 adds 1 to the variable i (S67) and proceeds to step S63.

On the other hand, if the variable i is not less than Ni (S66: N), this means that countermeasures have been derived for all attacker profiles 122 for one defender profile 123, so the countermeasure design unit 111 proceeds to step S68.

In step S68, the countermeasure design unit 111 compares variable j with Nj and determines whether variable j is less than Nj. If the result shows that variable j is less than Nj (S68: Y), this means that countermeasures have not been derived for all attacker profiles 122 for all defender profiles 123, so the countermeasure design unit 111 sets variable i to 1, adds 1 to variable j (S69), and proceeds to step S63.

On the other hand, if the variable j is not less than Nj (S68: N), this means that countermeasures have been derived for all attacker profiles 122 for all defender profiles 123, i.e., countermeasures of the Ni x Nj pattern have been derived. Therefore, the countermeasure design unit 111 outputs the derived countermeasures of the Ni x Nj pattern to the countermeasure selection unit 112 and terminates processing.

This countermeasure design process allows for practical joint exercises between attacker and defender groups, which would be difficult to conduct in an actual industrial control system 13, to be virtually conducted using the system model 121 in Ni x Nj patterns, and countermeasures for each can be derived.

Next, we will explain the processing operations of the countermeasure selection unit 112.

The countermeasure selection unit 112 displays on the input/output device 12 a list 100 (see Figure 10) of countermeasures for the Ni x Nj pattern designed and output by the countermeasure design unit 111, and accepts from the user a selection of the countermeasure to be actually applied to the industrial control system 13. The user can compare the countermeasures by referring to the list displayed on the input/output device 12 connected to the countermeasure selection unit 112, and select the most appropriate countermeasure.

Figure 10 is a diagram showing the list of countermeasures according to the first embodiment.

List 100 is a table that displays countermeasures for NixNj patterns, and includes entries corresponding to each countermeasure for the NixNj patterns. The entries in list 100 include fields for countermeasure 101, defender profile 102, attacker profile 103, and performance 104.

Countermeasures 101 displays the countermeasures corresponding to the entry. In countermeasures 101, the content of the countermeasure is written before the @ symbol, and the identification name of the information device 130 that is the target of the countermeasure is written after the @ symbol.

The defender profile 102 displays information (e.g., an identification name) that can identify the defender profile 123 from which the countermeasure corresponding to the entry was derived. In this embodiment, when the defender profile 123 is pressed (clicked), details of the defender profile 123 are displayed, as shown in Figure 5.

The attacker profile 103 displays information (e.g., an identification name) that can identify the attacker profile 122 from which the countermeasure corresponding to the entry was derived. In this embodiment, when the attacker profile 122 is pressed (clicked), details of the attacker profile 122 are displayed, as shown in Figure 4.

Performance 104 displays index values for one or more indicators that indicate performance. Performance 104 includes fields such as production volume 104A, security protection rate 104B, and safety risk avoidance rate 104C.

Production volume 104A displays the production volume when the countermeasure corresponding to the entry is implemented. Confidentiality protection rate 104B displays the confidentiality protection rate when the countermeasure corresponding to the entry is implemented. Safety risk avoidance rate 104C displays the safety risk avoidance rate when the countermeasure corresponding to the entry is implemented.

The user can select countermeasures to actually apply to the industrial control system 13 from the list 100 via the input/output device 12, taking into consideration the type of attacker expected, management priorities, and the impact on the target system.

The correspondence between countermeasures and the cost and speed required to apply the countermeasures may be stored in the storage unit 120, and the countermeasure selection unit 112 may display the cost and speed required to apply the countermeasures in association with the countermeasures in the list 100.

Furthermore, since there may be overlapping countermeasures among the countermeasures in the list 100, in this embodiment, the countermeasure selection unit 112 displays statistical information regarding the derived countermeasures.

Figure 11 is a diagram showing the configuration of statistical information on countermeasures in the first embodiment.

Statistical information is, for example, information about the percentage of overlap between each countermeasure among all countermeasures. Figure 11 shows a pie chart representing the overlap rate between each countermeasure. This statistical information makes it easy to identify countermeasures with a high overlap rate, i.e., countermeasures that are considered to be recommended.

When the user completes the selection of a countermeasure by the countermeasure selection unit 112, the countermeasure execution unit 113 controls the application of the countermeasure selected by the user to the information device 130. Specifically, the countermeasure execution unit 113 sends a communication command to the information device 130 to cause the information device 130 to execute the countermeasure.

In addition, after a countermeasure is selected, the countermeasure selection unit 112 may continuously monitor the anomaly detection information received from the anomaly detection system 11 and display information on the degree of match between the actually observed attacker behavior and the attacker profile.

Figure 12 is a diagram showing the structure of information indicating the relationship between observed attacker behavior and matches with attacker profiles in the first embodiment.

Figure 12 shows statistical information in the form of a bar graph showing the degree of agreement between some of the attacker's actual behavior (attack route, method, etc.) and the behavior estimated by each attacker profile. This statistical information makes it possible to determine which attacker profile is most effective for estimating each type of behavior.

Second Embodiment
Next, a cyber-attack response support system according to the second embodiment will be described.

Figure 13 is a functional block diagram of the cyber-attack response support system according to the second embodiment. Note that in the cyber-attack response support system 1100 according to the second embodiment, components similar to those in the cyber-attack response support system 1000 according to the first embodiment will be designated by the same reference numerals.

The cyber-attack response support system 1100 includes a new impact re-evaluation unit 114 in the processing unit 110.

The impact re-evaluation unit 114 starts operation based on a request from the countermeasure selection unit 112, reads the system model 121 and the attacker profile 122 and defender profile 123 corresponding to the selected countermeasure from the memory unit 120, and performs processing to evaluate the performance of the industrial control system 13.

The countermeasure selection unit 112 can accept multiple countermeasures from the user. When multiple countermeasures are accepted, the countermeasure selection unit 112 requests the impact re-evaluation unit 114 to instruct it to evaluate the impact on the target system if multiple countermeasures are implemented simultaneously, and displays the evaluation results from the impact re-evaluation unit 114 as an output table 1400 (see Figure 14).

Next, we will explain the processing operations of the cyber attack response support system 1100.

The processing operations up to the output of the list 100 of countermeasures for Ni x Nj patterns in the cyber-attack response support system 1100 are the same as those in the cyber-attack response support system 1000 of the first embodiment.

When multiple countermeasures are selected for the list 100, the countermeasure selection unit 112 requests the impact re-evaluation unit 114 to evaluate the impact on the target system if the selected countermeasures are implemented simultaneously.

When the impact re-evaluation unit 114 receives a request from the countermeasure selection unit 112, it reads from the storage unit 120 the system model 121 and the attacker profile 122 and defender profile 123 corresponding to the selected countermeasures, and updates the state of the information device 130 in the system model 121 to a state corresponding to the selected countermeasures. Next, the impact re-evaluation unit 114 uses the calculation function of the system model 121 to quantify the performance of the target system using one or more indicators, and returns the result to the countermeasure selection unit 112.

The countermeasure selection unit 112 creates an output table 1400 based on the results from the impact re-evaluation unit 114 and displays the output table 1400 on the input/output device 12. The user can refer to this output table 1400 to determine whether it is acceptable to apply multiple countermeasures simultaneously.

Figure 14 is a diagram showing the configuration of the output table for countermeasures in the second embodiment.

Output table 1400 is a table that displays information about the impact of simultaneously executing multiple selected countermeasures. Output table 1400 includes fields for countermeasure 1401, defender profile 1402, attacker profile 1403, and performance 1404.

Countermeasures 1401 displays multiple selected countermeasures. In the example of Figure 14, the countermeasures are "Stop device @PLC1" and "Change device operating mode @HMI."

The defender profile 1402 displays information (e.g., an identification name) that can identify the defender profile 123 from which each countermeasure was derived.

The attacker profile 1403 displays information (e.g., an identification name) that can identify the attacker profile 122 from which each countermeasure was derived.

Performance 1404 displays index values for one or more indicators that indicate the performance of the target system when multiple countermeasures are implemented simultaneously. Performance 1404 includes fields such as production volume 1404A, confidentiality protection rate 1404B, and safety risk avoidance rate 1404C.

Production volume 1404A displays the production volume when multiple countermeasures are implemented. Confidentiality protection rate 1404B displays the confidentiality protection rate when multiple countermeasures are implemented. Safety risk avoidance rate 1404C displays the safety risk avoidance rate when multiple countermeasures are implemented.

The user can refer to the output table 1400 to determine whether to execute multiple countermeasures simultaneously. When the countermeasure selection unit 112 receives an instruction from the user to execute multiple countermeasures, it notifies the countermeasure execution unit 113, and the countermeasure execution unit 113 controls the application of the notified multiple countermeasures to the information device 130.

(Third embodiment)
Next, a cyber-attack response support system according to the third embodiment will be described.

Figure 15 is a functional block diagram of a cyber-attack response support system according to the third embodiment. Note that in the cyber-attack response support system 1200 according to the third embodiment, components similar to those in the cyber-attack response support system 1000 according to the first embodiment will be designated by the same reference numerals.

Compared to the cyber-attack response support system 1000, the cyber-attack response support system 1200 includes a new defender model generation unit 115 in the processing unit 110, some of the processing operations of the countermeasure design unit 116 have been changed, and a new defender model 124 is stored in the memory unit 120.

In the cyber-attack response support system 1000 according to the first embodiment, when the anomaly detection system 11 detects an anomaly, it predicts the attacker's behavior based on the attacker profile, and then derives the defender's behavior, including optimal countermeasures, based on the defender profile. However, in the cyber-attack response support system 1200 according to the third embodiment, when the anomaly detection system 11 detects an anomaly in the target system, it derives optimal countermeasures without taking the step of predicting the attacker's behavior.

The defender model generation unit 115 reads the system model 121, attacker profile 122, and defender profile 123, and generates a defender model 124 that can input a system model that reflects the anomaly detection information of the anomaly detection system 11 and output countermeasures. The process of generating the defender model 124 by the defender model generation unit 115 (defender model generation process: see Figure 17) is executed at a stage before the anomaly detection system 11 detects an anomaly. One possible method of generating the defender model 124 is to use multi-agent reinforcement learning. When using multi-agent reinforcement learning, the defender model generation unit 115 learns the defender model 124, and the countermeasure design unit 111 executes the defender model.

Figure 16 is a diagram illustrating the defender model according to the third embodiment.

The defender model 124 has a calculation function that takes as input a system model 1601 that reflects the anomaly detection information of the anomaly detection system 11, for example, a system model 1601 that represents the state of the information devices 130 that make up the target system, and outputs an optimal countermeasure 1603 for the state of the information devices that make up the target system.

Next, we will explain the defender model generation process that generates a defender model.

Figure 17 is a flowchart of the defender model generation process according to the third embodiment. Figure 17 shows the defender model generation process that generates a defender model using multi-agent reinforcement learning.

The defender model generation unit 115 sets variables i and j to 1 (S1701). Next, the defender model generation unit 115 reads the system model 121, the attacker profile 122 for identifier i, and the defender profile 123 for identifier j from the storage unit 120 (S1702).

Next, the defender model generation unit 115 learns optimal behavior by operating an agent simulating an attacker (attacker agent) and an agent simulating a defender (defender agent) in the system model 121 environment (S1703).

Here, the actions that an attacker agent can perform are defined by the attack method in the attacker profile 122, and the reward that the attacker agent receives is determined by the attack objective in the attacker profile 122. For example, the reward that the attacker agent receives is determined according to the amount of change in the indicator defined in the attack objective. For example, an attacker agent generated based on the attacker profile 122-2, whose identification name is balanced in Figure 4, may receive a reward that increases with an increase in 0.3X + 0.4Y + 0.3Z.

Furthermore, the actions that a defender agent can perform are defined by the defense techniques of the defender profile 123, and the reward that the defender agent receives is determined by the defense objectives of the defender profile 123. For example, the reward that a defender agent receives is determined according to the amount of change in the indicator defined in the defense objectives. For example, a defender agent generated based on the defender profile 123-2, whose identifier name in Figure 5 is confidentiality protection rate-oriented, may receive a reward that increases as 0.1X + 0.7Y + 0.2Z decreases.

Next, the defender model generation unit 115 stores the defender agent that has completed multi-agent reinforcement learning and is capable of outputting optimal behavior depending on the state of the information device in the system model 121 in the memory unit 120 as the defender model 124 (S1704).

Next, the defender model generation unit 115 compares the variable i with Ni and determines whether the variable i is greater than Ni (S1705). If the result shows that the variable i is not greater than Ni (S1705: N), this means that a defender model has not been created by performing multi-agent reinforcement learning on all attacker profiles 122 for one defender profile 123, so the defender model generation unit 115 adds 1 to the variable i (S1706) and proceeds to step S1702.

On the other hand, if the variable i is greater than Ni (S1705: Y), this means that a defender model was created by performing multi-agent reinforcement learning on all attacker profiles 122 for one defender profile 123, and the defender model generation unit 115 proceeds to step S1707.

In step S1707, the defender model generation unit 115 compares variable j with Nj and determines whether variable j is greater than Nj. If the result is that variable j is not greater than Nj (S1707: N), this means that a defender model has not been created by performing multi-agent reinforcement learning on all attacker profiles 122 for all defender profiles 123, so the defender model generation unit 115 sets variable i to 1 and adds 1 to variable j (S1708), and proceeds to step S1702.

On the other hand, if the variable j is greater than Nj (S1707: Y), this means that a defender model has been created by performing multi-agent reinforcement learning on all attacker profiles 122 for all defender profiles 123, i.e., a defender model 124 of the Ni x Nj pattern has been derived. Therefore, the defender model generation unit 115 stores the derived defender model 124 of the Ni x Nj pattern in the memory unit 120 and terminates processing.

Next, we will explain the countermeasure design process performed by the cyber attack response support system 1200.

The countermeasure design process is executed by activating the countermeasure design unit 116 when the cyber-attack response support device 10 receives anomaly detection information about the target system (industrial control system 13) from the anomaly detection system 11.

The countermeasure design unit 116 reads the system model 121 and the defender model 124 from the memory unit 120, reflects the state corresponding to the received anomaly detection information in the system model 121, inputs the state of the information devices in the system model 121 reflecting the anomaly detection information into each of the Ni×Nj pattern defender models 124, calculates Ni×Nj pattern countermeasures using each defender model 124, and outputs the calculated Ni×Nj pattern countermeasures to the countermeasure selection unit 112. This countermeasure design process allows a joint practical exercise between an attacker group and a defender group, which would be difficult to implement in an actual industrial control system 13, to be virtually conducted using the system model 121 in an Ni×Nj pattern exercise, and derives respective countermeasures. Note that the subsequent processing by the countermeasure selection unit 112 and the countermeasure execution unit 113 is similar to that of the cyber-attack response support system 1000 according to the first embodiment.

With the cyber attack response support system 1200 according to this embodiment, after the anomaly detection system 11 detects an anomaly, there is no need to take steps to predict the attacker's behavior; instead, countermeasures can be derived using the Ni x Nj pattern defender model 124 that has been generated in advance for each combination of attacker profile and defender profile. This means that when a cyber attack occurs, countermeasures can be quickly presented to the user.

The present invention is not limited to the above-described embodiments, and can be modified and implemented as appropriate without departing from the spirit of the present invention.

For example, while the above embodiment illustrates an example that targets an industrial control system 13, the present invention is not limited to this and can be applied to general information systems.

Furthermore, in the above embodiment, an example is shown in which the anomaly detection system 11 is provided outside the industrial control system 13, but the present invention is not limited to this, and the anomaly detection system 11 may also be provided within the industrial control system 13.

Furthermore, in the above embodiments, some or all of the processing performed by the processor may be performed by a hardware circuit. Furthermore, the program in the above embodiments may be installed from a program source. The program source may be a program distribution server or a recording medium (e.g., a portable recording medium).

10...Cyber attack response support device, 11...Abnormality detection system, 12...Input/output device, 13...Industrial control system, 110...Processing unit, 111, 116...Countermeasure design unit, 112...Countermeasure selection unit, 113...Countermeasure execution unit, 114...Impact re-evaluation unit, 115...Defender model generation unit 120...Memory unit, 121...System model, 122...Attacker profile, 123...Defender profile, 124...Defender model, 1000, 1100, 1200...Cyber attack response support system

Claims (14)

A cyber attack response support system that designs countermeasures against cyber attacks on a predetermined target system,
a storage unit that stores one or more attacker profiles including attack objectives and attack methods of attackers who carry out cyber attacks, and one or more defender profiles including defense objectives and defense methods of defenders who defend against cyber attacks;
a countermeasure design unit that designs countermeasures for each combination of the attacker profile and the defender profile using a system model that reproduces the state of the target system and outputs index values of one or more indexes that indicate the performance of the target system corresponding to the state of the target system;
A cyber attack response support system equipped with The cyber attack response support system of claim 1, wherein the countermeasure design unit, when receiving detection information of a cyber attack against the target system, reflects the detection information in the system model and designs the countermeasure. The attack purpose of the attacker profile includes an attack purpose index and its target value, which are one or more indexes among the index values output by the system model,
The cyber attack response support system of claim 1, wherein the countermeasure design unit predicts the attacker's behavior that will maximize the impact on the attack purpose indicator, and uses the system model to determine the countermeasure for the predicted behavior. The defense objective of the defender profile includes a defense objective index and its target value, which are one or more indicators among the indicator values output by the system model,
The cyber attack response support system of claim 1, wherein the countermeasure design unit predicts the defender's behavior that minimizes the impact on the defense objective index, and determines the countermeasure for the predicted behavior using the system model. a display unit that displays countermeasure information that is information about the designed countermeasure,
The countermeasure information is
A cyber attack response support system as described in claim 1, including information on the content of the countermeasure, the corresponding attacker profile and defender profile, and information on the performance of the target system when the countermeasure is implemented. a reception unit that receives a selection of a countermeasure to be applied to the target system from the countermeasure information;
a countermeasure execution unit that applies the received countermeasure to the target system;
The cyber-attack response support system according to claim 5, comprising: The display unit
The cyber-attack response support system according to claim 5, wherein statistical information regarding the countermeasures is displayed. The cyber attack response support system of claim 1, wherein the system model is constructed based on the hardware, software, vulnerability information, logical configuration, physical configuration of the information devices that make up the target system, and dependency information between the information devices for the information devices to operate normally. The display unit
The cyber attack response support system of claim 5, which displays statistical information regarding the match between actual attacker behavior and the attacker profile based on detection information of cyber attacks against the target system. The reception unit
Accepting a selection of a plurality of countermeasures to be applied to the target system from among the countermeasures designed by Fukusu;
The cyber attack response support system according to claim 6, further comprising an impact re-evaluation unit that calculates information regarding performance in the target system when the received countermeasures are implemented. a defender model that receives detection information of a cyber-attack against the target system as an input and outputs a countermeasure for each combination of the attacker profile and the defender profile;
The cyber-attack response support system according to claim 1 , wherein the countermeasure design unit designs the countermeasures based on the defender model. 12. The cyber attack response support system according to claim 11, further comprising a defender model generation unit that creates the defender model that outputs the countermeasure for each combination by learning the optimal behavior of an attacker agent that acts based on each of the attacker profiles and a defender agent that acts based on each of the defender profiles. A cyber-attack response support method by a cyber-attack response support system that designs countermeasures against cyber-attacks on a predetermined target system,
storing one or more attacker profiles including the attack objectives and attack techniques of attackers who carry out cyber attacks, and one or more defender profiles including the defense objectives and defense techniques of defenders who defend against cyber attacks;
A cyber-attack response support method that uses a system model that reproduces the state of the target system and outputs index values of one or more indicators that indicate the performance of the target system corresponding to the state of the target system, and designs countermeasures for each combination of the attacker profile and the defender profile. A cyber-attack response support program that is executed by a computer to design countermeasures against cyber-attacks on a predetermined target system,
The computer
a storage unit that stores one or more attacker profiles including attack objectives and attack methods of attackers who carry out cyber attacks, and one or more defender profiles including defense objectives and defense methods of defenders who defend against cyber attacks;
A cyber attack response support program that functions as a countermeasure design unit that designs countermeasures for each combination of the attacker profile and the defender profile, using a system model that reproduces the state of the target system and outputs index values of one or more indicators that indicate the performance of the target system corresponding to the state of the target system.