A progress status of an attack on an information system possibly carried out is visualized to display a warning to a user, without using a correlation rule. A table storage stores a past case table indicating a phase string obtained by concatenating phase values indicating attack progress degrees according to an event occurrence pattern in a past case. A phase string generator obtains a phase string by concatenating phase values according to the occurrence pattern of events that have occurred in the information system. A similarity degree calculator calculates a similarity degree between the obtained phase string and the phase string indicated in the past case table. An attack status visualization unit visualizes the progress status of the attack on the information system, based on the obtained phase string and a result of calculation of the similarity degree by the similarity degree calculator.

TECHNICAL FIELD

The present invention relates to a technology for visualizing a threat to an information system.

BACKGROUND ART

In a conventional threat visualization method (disclosed in Patent Literature 1, for example), occurrence of a threat is determined based on a correlation rule that defines the occurrence order of events considered to be the threat, and the events matching the correlation rule are displayed on a screen to warn a user.

CITATION LIST

Patent Literature

SUMMARY OF INVENTION

Technical Problem

In the conventional threat visualization method, there is a problem that the screen for warning is not displayed to the user unless the events defined in the correlation rule are all detected.

The events defined in the correlation rule are abnormal events considered to be malicious behaviors, which may occur in a network device, a server, and a computer such as a PC (Personal Computer).

Such events are detected by a sensor, for example, and the detected events are notified to an apparatus whose screen is monitored by the user. Detection omission, however, may occur in the detection of these abnormal events by the sensor.

Consequently, in the conventional threat visualization method, there is a problem that, though an attack on an information system is actually being carried out, the correlation rule is not satisfied due to detection omission of one event, so that a warning is not displayed to the user.

A main object of the present invention is to solve the problem as mentioned above. It is the main object of the present invention to visualize a progress status of an attack and display a warning to a user without using a correlation rule when the attack on an information system is possibly being carried out.

Solution to Problem

An information processing apparatus according to the present invention may include:

an attack event table storage unit that stores an attack event table indicating, for each of a plurality of events caused from an attack on an information system, a progress degree of the attack at a time when each event occurs;

an attack event progress degree string table storage unit that stores an attack event progress degree string table indicating a character string as an attack event progress degree string, the character string being obtained by concatenating the progress degrees of corresponding events according to an occurrence pattern of events in an attack sequence;

an occurred event progress degree string derivation unit that concatenates the progress degrees of corresponding events according to the occurrence pattern of the events that have occurred in the information system, and derives an occurred event progress degree string that is a character string;

a similarity degree calculation unit that calculates a similarity degree between the occurred event progress degree string derived by the occurred event progress degree string derivation unit and the attack event progress degree string indicated in the attack event progress degree string table; and

an attack status visualization unit that visualizes a progress status of the attack on the information system, based on the occurred event progress degree string obtained by the occurred event progress degree string derivation unit and a result of calculation of the similarity degree by the similarity degree calculation unit.

Advantageous Effects of Invention

In the present invention, the occurred event progress degree string is derived according to the occurrence pattern of the events that have occurred in the information system, and the similarity degree between the occurred event progress degree string and the attack event progress degree string is calculated.

Further, in the present invention, the progress status of the attack on the information system is visualized, based on the occurred event progress degree string and the result of calculation of the similarity degree.

Consequently, according to the present invention, use of a correlation rule is not required, so that a situation may be avoided where a warning is not displayed to a user because the correlation rule is not satisfied due to detection omission of one event, and therefore the warning can be displayed to the user when the attack is possibly being carried out.

DESCRIPTION OF EMBODIMENTS

In this embodiment, a description will be directed to a configuration in which, even if detection omission of an individual abnormal event has occurred, a warning is displayed to a user when an attack is possibly being carried out.

FIG. 1shows a configuration example of an information system according to this embodiment.

The information system according to this embodiment is configured with a threat visualization system100, a LAN (Local Area Network)110, a log server111, PCs112, an authentication server113, a file server114, a mail server115, an IDS (Intrusion Detection System)/IPS (Intrusion Prevention System)116, a network proxy117, and a firewall118, for example.

The threat visualization system100is a computer that visualizes a threat to the information system, and corresponds to an example of an information processing apparatus.

The threat visualization system100is connected to the LAN110.

The log server111, the PCs112, the authentication server113, the file server114, the mail server115, the IDS/IPS116, the network proxy117, and the firewall118are connected to the LAN110.

The firewall118is connected to an Internet119.

Usually, a plurality of the PCs112are present.

Each PC112corresponds to an example of a terminal device.

As illustrated inFIG. 2, the threat visualization system100includes a CPU101, a RAM (Random Access Memory)102, a ROM (Read Only Memory)103, a hard disk104, a displaying display105, a keyboard106, a mouse107, and a communication board108. These are connected to a bus109.

The threat visualization system100includes a functional configuration illustrated inFIG. 5.

Referring toFIG. 5, a table storage unit1001stores various tables used for visualizing a threat to the information system.

Details of the various tables will be described later.

The table storage unit1001corresponds to an example of an attack event table storage unit and an attack event progress degree string table storage unit.

The table storage unit1001is implemented by the RAM102and the hard disk104inFIG. 2.

According to the occurrence pattern of events that have occurred in the information system, a phase string generation unit1002concatenates phase values that indicate progress degrees of the events, thereby generating a phase string (occurred event progress degree string).

The phase string generation unit1002corresponds to an example of an occurred event progress degree derivation unit.

The phase string generation unit1002is constituted as a program, for example, and the program that implements the phase string generation unit1002is executed by the CPU101inFIG. 2.

A similarity degree calculation unit1003calculates a similarity degree between the phase string (occurred event progress degree string) obtained by the phase string generation unit1002and a phase string indicated in a past case table or an attack scenario table that will be described later.

The similarity degree calculation unit1003is also constituted as a program, for example, and the program that implements the similarity degree calculation unit1003is executed by the CPU101inFIG. 2.

An attack status visualization unit1004visualizes a progress status of an attack on the information system, based on the phase string obtained by the phase string generation unit1002and a result of calculation of the similarity degree by the similarity degree calculation unit1003.

The attack status visualization unit1004is also constituted as a program, for example, and the program that implements the attack status visualization unit1004is executed by the CPU101inFIG. 2.

An input unit1005inputs various data from a user of the threat visualization system100.

The input unit1005is implemented by the keyboard106and the mouse107inFIG. 2.

An output unit1006displays various data to the user of the threat visualization system100.

The output unit1006displays the progress status of the attack visualized by the attack status visualization unit1004to the user, for example.

The output unit1006is implemented by the displaying display105inFIG. 2.

A communication unit1007communicates with other apparatuses through the LAN110.

The communication unit1007receives log data from the log server111, for example.

The communication unit1007is implemented by the communication board108inFIG. 2.

FIG. 3illustrates tables stored in the hard disk104inFIG. 2.

An attack event table201, a past case table202, an attack scenario table203, and a threat visualization program204are stored in the hard disk104.

The threat visualization program204is a program that implements the phase string generation unit1002, the similarity degree calculation unit1003, and the attack status visualization unit1004inFIG. 5.

The threat visualization program204is loaded onto the RAM102. The CPU101reads the threat visualization program204from the RAM102, and then executes the threat visualization program204, thereby implementing the functions of the phase string generation unit1002, the similarity degree calculation unit1003, and the attack status visualization unit1004inFIG. 5.

Though not illustrated inFIG. 3, the hard disk104stores an OS (Operating System). The CPU101executes the threat visualization program204, using the OS.

FIG. 4illustrates a table generated on the RAM102.

An attack phase table301is generated on the RAM102by the threat visualization program204.

FIG. 6illustrates a configuration of the attack event table201.

The attack event table201is a table in which, when each of a plurality of events caused from an attack on the information system has occurred, a progress degree of the attack is indicated.

As illustrated inFIG. 6, the attack event table201includes a device type401, an event ID402, an event description403, and a phase404, for each event caused from the attack.

The device type401indicates a device (such as the PC112, or the authentication server113) from which the event has occurred.

An identifier for each event is given in the field of the event ID402.

An outline of each event is given in the field of the event description403.

The value of a phase representing a progress degree or a stage of the attack is given in the field of the phase404.

To take an example, the event to be observed when the attack is in the state of “intrusion” may be defined to be a phase “1”, the event to be observed when the attack is in the state of “search” may be defined to be a “phase2”, the event to be observed when the attack is in the state of “privilege elevation” may be defined to be a “phase3”, and the event when the attack is in the state of “information theft” may be defined to be a “phase4”.

FIG. 7illustrates a configuration of the past case table202.

The past case table202is a table in which events that occurred in each past case of an attack (attack sequence) are indicated in the order of occurrence.

The past case table202includes a past case ID501, an event ID string502, and a phase string503.

An identifier for the past case is given in the field of the past case ID501.

Event IDs for the events that occurred in the past case of the attack are given in the field of the event ID string502in the order of occurrence.

A character string (phase string) is given in the field of the phase string503. The character string (phase string) is obtained by concatenating the values in the phase404corresponding to the respective event IDs given in the field of the event ID string502.

The character string given in the field of the phase string503corresponds to an example of an attack event progress degree string.

The past case table202corresponds to an example of an attack event progress degree string table.

FIG. 8illustrates a configuration of the attack scenario table203.

The attack scenario table203is a table in which events assumed to occur in each assumed attack (attack sequence) are indicated in the order of occurrence.

An attack which does not actually occur but whose occurrence is assumed, is called an attack scenario.

An attack obtained by transformation of a part of an attack that actually occurred in the past may be used as the attack scenario, for example.

The attack scenario table203includes a scenario ID601, an event ID string602, and a phase string603.

An identifier for each attack scenario is given in the field of the scenario ID601.

Event IDs for the events whose occurrence is assumed when the attack is carried out are given in the field of the event ID string602in the order of occurrence of the events.

A character string (phase string) is given in the field of the phase string603. The character string (phase string) is obtained by concatenating the values in the phase404corresponding to the respective event IDs given in the field of the event ID string602in the order of occurrence.

The character string given in the field of the phase string603corresponds to an example of an attack event progress degree string.

The attack scenario table203corresponds to an example of an attack event progress degree string table.

FIG. 9illustrates a configuration of the attack phase table301.

The attack phase table301is a table generated by the phase string generation unit1002according to the occurrence pattern of events that have occurred in the information system. The attack phase table301is generated after analyzing log data from the log server111by the phase string generation unit1002.

The attack phase table301includes a device ID701, a phase string702, a maximum phase703, an update date and time704, a past case ID705, a case similarity degree706, a scenario ID707, and a scenario similarity degree708.

An IP (Internet Protocol) address of each PC112is usually given in the field of the device ID701(an address for the device ID701is not limited to the IP address, and a MAC (Media Access Control) address or the like may be used for the device ID701as long as the PC can be uniquely identified).

A character string obtained by concatenating the values in the phase404corresponding to the respective events extracted by the log data analysis in the order of occurrence is given in the field of the phase string702.

A maximum one of the values in the phase string702is given in the field of the maximum phase703.

A date and time described in the log data that has been last referred to by the phase string generation unit1002is given in the field of the update date and time704.

The past case ID501of the past case, based on which a similarity degree shown in the field of the case similarity degree706has been calculated, is given in the field of the past case ID705.

A maximum one of similarity degrees of the past cases calculated by the similarity degree calculation unit103with respect to the phase string702is given in the field of the case similarity degree706.

The scenario ID601of the attack scenario, based on which a similarity degree indicated in the field of the scenario similarity degree708has been calculated, is given in the field of the scenario ID707.

A maximum one of similarity degrees of the attack scenarios calculated by the similarity degree calculation unit1003with respect to the phase string702is given in the field of the scenario similarity degree708.

FIG. 10illustrates a screen example of a security threat distribution screen.

A security threat distribution screen801includes a phase display802, a total number display803, a past case display selection box804, an attack scenario display selection box805, and a similarity degree display region806.

The phase display802displays the name of each phase.

The total number display803displays the total number of the devices belonging to the phase.

The past case display selection box804is a check box for selecting display of similarity with one of the past cases.

The attack scenario display selection box805is a check box for selecting display of similarity with one of the attack scenarios.

The similarity degree display region806displays one or more of the devices belonging to each phase according to the similarity degree.

The security threat distribution screen801is generated by the attack status visualization unit1004and is displayed by the output unit1006.

Reference symbol Δ indicates a similarity degree with the past case, and reference symbol □ indicates a similarity degree with the attack scenario, in the similarity degree display region806.

Each of the reference symbols Δ and □ indicates the PC112.

The horizontal axis of the similarity degree display region806indicates a similarity degree value (0.0 to 1.0 inclusive), while the vertical axis of the similarity degree display region806indicates the number of the PCs112.

On the security threat distribution screen801, for each device ID in the attack phase table (inFIG. 9), in the similarity degree display region806of the phase corresponding to the value of the maximum phase703, the reference symbol Δ is plotted at a position corresponding to the value of the case similarity degree706and the reference symbol □ is plotted at a position corresponding to the value of the scenario similarity degree708.

In the record (device ID: ID1) at a first row inFIG. 9, for example, the maximum phase703is “3”, and the case similarity degree706is “0.57”. Thus, the reference symbol Δ is plotted at a position indicated by reference sign807inFIG. 10(since the attack scenario display selection box805of the phase3is not checked inFIG. 10, the reference symbol □ for the scenario similarity degree708of “0.66” is not displayed).

Similarly, in the record (device ID: ID2) at a second row inFIG. 9, the maximum phase703is “2”, and the case similarity degree706is “0.57”. Thus, the reference symbol Δ is plotted at a position indicated by reference sign808inFIG. 10, for example (since the attack scenario display selection box805of the phase2is not checked inFIG. 10, the reference symbol □ for the scenario similarity degree708of “0.5” is not displayed).

By plotting a relationship between the maximum phase703and the maximum similarity degree (the case similarity degree706and/or the scenario similarity degree708) extracted for each PC112, and by displaying the graphs indicating distributions of the maximum phase703and the maximum similarity degree with respect to the plurality of the PCs112in this manner, the progress status of the attack on the information system may be visualized.

FIG. 11illustrates a screen example of a security growth process display screen.

A security growth process display screen901includes a growth process display region902and a similarity degree display903. The growth process display region902displays an occurrence process of events with respect to a specific one of the devices together with the occurrence process of the similar past case. The similarity degree display903displays a similarity degree between these occurrence processes.

That is, on the security growth process display screen901, a phase value transition in the phase string702of a specific one of the PCs112and a phase value transition in the phase string603of the past case indicated in the past case ID705are graph-displayed in the growth process display region902.

The value of the case similarity degree706of the PC112is displayed on the similarity degree display903.

FIG. 9illustrates an example where the occurrence process of the events with respect to the specific device is displayed together with the occurrence process of the similar past case. The occurrence process of the events with respect to the specific device may be displayed together with the occurrence process of the similar attack scenario.

The progress status of the attack on the information system is visualized on the security growth process display screen901by such a method.

Next, operation will be described.

A general user accesses the authentication server113using the PC112to perform authentication based on a user ID and a password, and then accesses the file server114.

The user accesses the mail server115using the PC112to read or write a mail.

The user accesses the Internet119through the network proxy117and further through the firewall118, using the PC112.

The PC112, the authentication server113, the file server114, the mail server115, the network proxy117, and the firewall118each output predetermined log data (hereinafter also referred to just as a log) when these operations are performed by the general user.

The IDS/IPS116outputs predetermined log data when communication of a packet matching a predetermined condition is observed on the LAN110.

The log data of these devices are transmitted to the log server111, and are recorded in the log server111according to the time series of times described in the log data.

In the threat visualization system100, the threat visualization program204stored in the hard disk104is loaded from the hard disk104onto the RAM102through the bus109, and is then executed by the CPU101.

The threat visualization program204sequentially extracts the logs recorded in the log server111according to the time series through the LAN110.

The logs from the log server111each include an event occurrence date and time, a log type, an event ID, a device ID, and an event description of an individual occurred event recorded therein.

The event occurrence date and time indicates a date and time on which the event recorded in the log has occurred.

The log type indicates the type of the device in which the event recorded in the log has occurred.

The event ID indicates an ID whereby the type of the individual occurred event may be uniquely identified.

The device ID indicates an ID whereby the device in which the event has occurred is uniquely identified.

The log that has recorded passage of a packet or the like includes two device IDs, which are the device ID of a transmission source and the device ID of a transmission destination.

The event description indicates a description of details of the individual occurred event.

FIG. 12illustrates a basic flow of processes to be executed by the threat visualization system100for each occurred event recorded in each of the extracted logs.

The processes in steps S1001to S1003illustrated inFIG. 12are repetitively executed in a cycle of five minutes, for example.

The cycle of five minutes is just an exemplification, and an arbitrary cycle may be set, according to the size of the information system and a security policy.

In flowcharts inFIGS. 12 to 18, the procedure of the processes is described in the form of operations of the phase string generation unit1002, the similarity degree calculation unit1003, and the attack status visualization unit1004.

Each variable value and each counter value described with reference toFIGS. 13 and 18are managed by a register of the CPU101or the RAM102, for example.

In step S1001, the phase string generation unit1002generates an attack phase string (details of which will be described later) for the PC12, based on the occurred event recorded in the extracted log.

Next, in step S1002, the similarity degree calculation unit1003calculates a similarity degree between the attack phase string generated in step S1001and the past case, and calculates a similarity degree between the attack phase string generated in step S1001and the attack scenario.

Further, in step S1003, the attack status visualization unit1004displays the attack phase string generated in step S1001and the similarity degrees calculated in step S1002on the displaying display105.

FIG. 13describes the process in step S1001in detail.

In step S2001, the phase string generation unit1002determines whether the maximum phase703with respect to the PC112corresponding to the device ID associated with the occurred event recorded in the extracted log is zero.

If the difference between the dates and times is T1or more in step S2002, the phase string generation unit1002initializes the record in the attack phase table301with respect to the PC112.

Specifically, the phase string generation unit1002updates the phase string702to 0, updates the maximum phase703to 0, and updates the update date and time704to no record (−).

If the difference between the dates and times is less than T1in step S2002, the phase string generation unit1002executes step S2004.

In step S2004, the phase string generation unit1002determines based on the event ID402whether an event ID matching the event ID of the occurred event recorded in the extracted log is present in the attack event table201.

If the event ID matching the event ID of the occurred event recorded in the log is not present in the attack event table201in step S2004, the phase string generation unit1002finishes the process.

On the other hand, if the event ID matching the event ID of the occurred event recorded in the log is present in the attack event table201in step S2004, the phase string generation unit1002adds the phase value of the corresponding event to the end of the phase string702in the record in the attack phase table301with respect to the PC112, in step S2005.

Next, in step S2006, the phase string generation unit1002compares the phase value of the event mentioned before and obtained from the attack event table201and the maximum phase703in the record in the attack phase table301with respect to the PC112.

If the phase value is not larger than the maximum phase703in step S2006, the phase string generation unit1002updates the update date and time704in the record with respect to the PC112in the attack phase table301, by replacing the update and time704with the event occurrence date and time of the occurred event, in step S2008, and then finishes the process.

On the other hand, if the phase value is larger than the maximum phase703in step S2006, the phase string generation unit1002updates the maximum phase703in the record with respect to the PC112in the attack phase table301, by replacing the maximum phase703with this phase value in step S2007, and then executes step S2008.

FIG. 14describes the process in step S1002in detail.

In step S3001, the similarity degree calculation unit1003initializes a variable A for storing the past case ID501in the past case table202by 0001 that is the ID listed first in the table and initializes a variable B for storing the similarity degree by 0.

Next, the similarity degree calculation unit1003calculates a similarity degree S between the phase string503associated with the past case ID stored in the variable A and the phase string702of the PC112, in step S3002.

Specifically, the similarity degree S is calculated, using the following equation when a function for calculating a Levenshtein edit distance is indicated by D, the phase string503associated with the past case ID in the variable A is indicated by P1, and the phase string702of the PC112is indicated by P2.

The function for calculating a Levenshtein edit distance is configured to calculate an edit distance between two character strings with insertion, deletion, or substitution used as one edit operation.

With respect to the following equation, |x| indicates the length of a character string x, and Max ( ) indicates a function for returning one of a plurality of arguments having a largest argument value.

Next, the similarity degree calculation unit1003determines whether the similarity degree S calculated in step S3002is larger than the similarity degree in the variable B, in step S3003.

If the similarity degree S is larger than the similarity degree in the variable B in step S3003, the similarity degree calculation unit1003updates the variable B and the case similarity degree706with respect to the PC112in the attack phase table301by the similarity degree S, and updates the past case ID705with respect to the PC112in the attack phase table301by the variable A, in step S3004.

Next, in step S3005, the similarity degree calculation unit1003checks whether the variable A is the past case ID listed last in the past case table202. If the variable A is not the last past case ID, the similarity degree calculation unit1003updates the variable A to the next past case ID in the past case table202, in step S3006. Then, the similarity degree calculation unit1003repeats the processes after step S3002.

On the other hand, if the variable A is the last past case ID in the past case table202in step S3005, the similarity degree calculation unit1003next executes step S3007.

In step S3007, the similarity degree calculation unit1003respectively initializes a variable C for storing the scenario ID601in the attack scenario table203by 0001 that is the ID listed first in the table and initializes a variable E for storing the similarity degree by 0.

Next, the similarity degree calculation unit1003calculates a similarity degree S between the phase string603associated with the scenario ID in the variable C and the phase string702of the PC112, in step S3008.

The similarity degree S is calculated using the same equation as in step S3002

Next, the similarity degree calculation unit1003determines whether the similarity degree S calculated in step S3008is larger than the similarity degree in the variable E, in step S3009.

If the similarity degree S is larger than the similarity degree stored in the variable E in step S3009, the similarity degree calculation unit1003updates the scenario similarity degree708with respect to the PC112in the attack phase table301and the variable E by the similarity degree S, and updates the scenario ID707with respect to the PC112in the attack phase table301by the value of the variable C, in step S3010.

Next, the similarity degree calculation unit1003checks whether the variable A is the past case ID listed last in the attack scenario table203in step S3011. If the variable A is not the last scenario ID, the similarity degree calculation unit1003updates the variable C to the next scenario ID in the attack scenario table203, in step S3012. Then, the similarity degree calculation unit1003repeats the processes after step S3008.

On the other hand, if the variable C is the last scenario ID in the attack scenario table in step S3011, the similarity degree calculation unit1003finishes the process.

FIGS. 15 to 17describe the process in step S1003in detail.

In step S4001, the attack status visualization unit1004sets 0001 in a variable F for the device ID, and initializes four counters N1to N4to 0 (seeFIG. 15).

Next, in step S4002, the attack status visualization unit1004checks whether the device ID in the variable F is larger than the last device ID (seeFIG. 15).

If the device ID of the variable F is larger than the last device ID in step S4002, the attack status visualization unit1004respectively displays values of the counters N1to N4on the total number displays803of the phases1to4, in step S4025(seeFIG. 15).

If the device ID of the variable F is not larger than the last device ID in step S4002, the attack status visualization unit1004changes a subsequent process according to the value of the maximum phase703in step S4003.

If the past case display selection box804has been checked in step S4004, the attack status visualization unit1004draws the reference symbol ‘Δ’ at a position corresponding to the value of the case similarity degree706in the similarity degree display region806of the phase1, in step S4005(seeFIG. 16).

Next, the attack status visualization unit1004determines whether the attack scenario display selection box805of the phase1has been checked, in step S4006(seeFIG. 16).

If the attack scenario display selection box805has been checked in step S4006, the attack status visualization unit1004draws ‘□’ at a position corresponding to the value of the scenario similarity degree708in the similarity degree display region806of the phase1, in step S4007(seeFIG. 16).

Next, the attack status visualization unit1004increments the counter N1by 1 in step S4008(seeFIG. 16).

Then, the attack status visualization unit1004increments the variable F that stores the device ID by 1 in step S4024, and then repeats the processes after S4002.

Also if the maximum phase is 2, 3, or 4 in step S4003, the attack status visualization unit1004performs similar processes, as inFIGS. 16and17.

Since the operation of the attack status visualization unit1004is the same also if the maximum phase is 2, 3, or 4, description of the operation of the attack status visualization unit1004will be omitted.

Meanwhile, if the maximum phase is 0 in step S4003, the attack status visualization unit1004increments the variable F that stores the device ID by 1 in step S4024, and repeats the processes after step S4002.

FIG. 18explains a process when the security growth process display screen901is displayed. The security growth process display screen901is displayed when the reference symbol Δ or □ displayed on display of security threat distributions inFIG. 10is selected by the mouse107.

In step S5001, the attack status visualization unit1004obtains from the attack phase table301the phase string702with respect to the device ID that has been selected.

Next, in step S5002, the attack status visualization unit1004displays a graph in the growth process display region902, according to the phase string702obtained before.

Next, in step S5003, the attack status visualization unit1004checks whether the symbol with respect to the past case is selected.

If it is found out that the symbol with respect to the past case is selected in the check of step S5003, the attack status visualization unit1004obtains from the attack phase table301, the past case ID705with respect to the selected device ID, in step S5004.

Next, in step S5005, the attack status visualization unit1004obtains from the past case table202the phase string503corresponding to the past case ID705.

Next, in step S5006, the attack status visualization unit1004displays a graph in the growth process display region902according to the phase string503.

Next, in step S5007, the attack status visualization unit1004displays the case similarity degree706on the similarity degree display903, and finishes the process.

If the symbol with respect to the past case is not selected in step S5003, the attack status visualization unit1004executes processes from step S5008to step S5011, displays a graph in the growth process display region902according to the phase string603, and displays the scenario similarity degree708on the similarity degree display903(description will be omitted because the processes are similar to those in step S5004to step S5007.).

As described above, the threat visualization system according to this embodiment divides a threat growth process into the attack phases, and visualizes and displays the threat growth process, based on similarity with the past case or the attack scenario. Thus, a user may determine importance of a threat based on the similarity.

Since the threat visualization system according to this embodiment visualizes and displays the threat growth process, the user may grasp to what extent the threat is growing.

As described above, in this embodiment, the description has been given about a threat visualization method in which the threat in progress is displayed based on a similarity degree with the past case, for each phase, using the attack event table and the past case table. In the attack event table, each threat is sorted out into one of the attack phases. In the past case table, events that occurred in each past case are recorded after being sorted out into one of the attack phases.

Further, in this embodiment, the description has been given about a threat visualization method in which the threat in progress is displayed based on a similarity degree with the attack scenario, for each phase, using the attack event table and the attack scenario table. In the attack event table, each threat is sorted out into one of the attack phases. In the attack scenario table, events that are predicted to occur based on each attack scenario are recorded after being sorted out into one of the attack phases.

In this embodiment, the description has been given about a threat visualization method in which each device where a threat in progress has occurred is totalized and displayed, for each phase of an attack that made intrusion.

In this embodiment, the description has been given about a threat visualization method in which a threat growth process is displayed together with the growth process of the similar past case in the form of graphs.

In this embodiment, the description has been given about a threat visualization method in which a threat growth process is displayed together with the growth process of the similar attack scenario in the form of graphs.

REFERENCE SIGNS LIST

100: threat visualization system,1001: table storage unit,1002: phase string generation unit,1003: similarity degree calculation unit,1004: attack status visualization unit,1005: input unit,1006: output unit,1007: communication unit