Patent Publication Number: US-2021168170-A1

Title: Installation location selection assistance apparatus, installation location selection assistance method, and computer readable medium

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     This application is a Continuation of PCT International Application No. PCT/JP2018/019665 filed on May 22, 2018, which is hereby expressly incorporated by reference into the present application. 
    
    
     TECHNICAL FIELD 
     The present invention relates to a technology to assist selection of an installation location of an intrusion detection system (IDS) that detects unauthorized access. 
     BACKGROUND ART 
     In the development of information technology (IT) systems, it is essential to identify threats by conducting security analysis, clarify necessary security countermeasures, and then implement or introduce appropriate security countermeasures. 
     In order to perform this work, an analyst with a high level of security expertise is required. This work will take a lot of time even when performed by the analyst with a high level of security expertise. 
     Patent Literature 1 describes allowing an optimal combination of countermeasure candidates to be selected for each combination of attack activities to be dealt with, according to actual attack situations. 
     CITATION LIST 
     Patent Literature 
     
         
         Patent Literature 1: JP 6253862 B 
       
    
     SUMMARY OF INVENTION 
     Technical Problem 
     By using the technology described in Patent Literature 1, it is possible to determine a combination of security countermeasures appropriate for each business operator. However, there are security countermeasures that require more detailed determinations. Specifically, when a security countermeasure of “to introduce an intrusion detection system” is adopted, a location where an intrusion detection system is to be installed will remain arbitrary with only “to introduce an intrusion detection system”. 
     It is an object of the present invention to assist selection of an installation location of an intrusion detection system. 
     Solution to Problem 
     An installation location selection assistance apparatus according to the present invention includes: 
     a combination identification unit to identify combinations of one or more components which constitute a target system and in each of which an intrusion detection system that detects unauthorized access can be installed; and 
     a combination reduction unit to extract, from the combinations identified by the combination identification unit, a combination that can detect an unauthorized communication indicated by attack information. 
     Advantageous Effects of Invention 
     In the present invention, combinations of components in each of which an intrusion detection system can be installed are identified, and combinations that can detect an unauthorized communication are extracted. This limits locations where an intrusion detection system is to be installed. Therefore, selection of a location where an intrusion detection system is to be installed is facilitated. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  is a hardware configuration diagram of an installation location selection assistance apparatus  10  according to a first embodiment; 
         FIG. 2  is a functional configuration diagram of the installation location selection assistance apparatus  10  according to the first embodiment; 
         FIG. 3  is a flowchart illustrating operation of the installation location selection assistance apparatus  10  according to the first embodiment; 
         FIG. 4  is a diagram illustrating an example of system configuration information according to the first embodiment; 
         FIG. 5  is a diagram illustrating a graph converted from the system configuration information illustrated in  FIG. 4 ; 
         FIG. 6  is a diagram illustrating combinations identified from the system configuration information illustrated in  FIG. 5 ; 
         FIG. 7  is a diagram illustrating an example of an attack tree, which is attack information, according to the first embodiment; 
         FIG. 8  is a diagram describing a method for calculating a coverage according to the first embodiment; 
         FIG. 9  is a diagram illustrating an example of results of calculating coverages according to the first embodiment; 
         FIG. 10  is a diagram illustrating information stored in a product information storage unit  34  according to the first embodiment; 
         FIG. 11  is a diagram illustrating examples of an objective function according to the first embodiment; and 
         FIG. 12  is a configuration diagram of the installation location selection assistance apparatus  10  according to a first variation. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     First Embodiment 
     ***Description of Configuration*** 
     Referring to  FIG. 1 , a hardware configuration of an installation location selection assistance apparatus  10  according to a first embodiment will be described. 
     The installation location selection assistance apparatus  10  is a computer. 
     The installation location selection assistance apparatus  10  includes hardware of a processor  11 , a storage device  12 , a data interface  13 , an input interface  14 , and a display interface  15 . The processor  11  is connected with the other hardware components via signal lines and controls the other hardware components. 
     The processor  11  is an integrated circuit (IC) that performs processing. Specific examples of the processor  11  are a central processing unit (CPU), a digital signal processor (DSP), and a graphics processing unit (GPU). 
     The storage device  12  is a storage device to store data. A specific example of the storage device  12  is a hard disk drive (HDD). Alternatively, the storage device  12  may be a portable recording medium, such as a Secure Digital (SD, registered trademark) memory card, CompactFlash (CF, registered trademark), a NAND flash, a flexible disk, an optical disc, a compact disc, a Blu-ray (registered trademark) disc, or a digital versatile disc (DVD). 
     The data interface  13  is an interface for inputting data from and outputting data to external devices. A specific example of the data interface  13  is an Ethernet (registered trademark) port. 
     The input interface  14  is a device for connecting an input device to be operated by a user. A specific example of the input interface  14  is a Universal Serial Bus (USB) port. 
     The display interface  15  is a device for connecting a display device. A specific example of the display interface  15  is a High-Definition Multimedia Interface (HDMI, registered trademark) port. 
     Referring to  FIG. 2 , a functional configuration of the installation location selection assistance apparatus  10  according to the first embodiment will be described. 
     The installation location selection assistance apparatus  10  includes, as functional components, a system configuration input unit  21 , an installation condition input unit  22 , a threshold input unit  23 , an attack information input unit  24 , a parameter input unit  25 , an installation location identification unit  26 , a combination identification unit  27 , a combination reduction unit  28 , a detection place identification unit  29 , a coverage calculation unit  30 , an objective function generation unit  31 , an objective function calculation unit  32 , an output unit  33 , and a product information storage unit  34 . 
     The functions of the system configuration input unit  21 , the installation condition input unit  22 , the threshold input unit  23 , the attack information input unit  24 , and the parameter input unit  25  are realized by at least one of the data interface  13  and the input interface  14 . The functions of the installation location identification unit  26 , the combination identification unit  27 , the combination reduction unit  28 , the detection place identification unit  29 , the coverage calculation unit  30 , the objective function generation unit  31 , and the objective function calculation unit  32  are realized by the processor  11 . The function of the output unit  33  is realized by the display interface  15 . The function of the product information storage unit  34  is realized by the storage device  12 . 
     The functions of the functional components of the installation location identification unit  26 , the combination identification unit  27 , the combination reduction unit  28 , the detection place identification unit  29 , the coverage calculation unit  30 , the objective function generation unit  31 , and the objective function calculation unit  32  are realized by software. The storage device  12  stores programs for realizing the functions of these functional components. These programs are read by the processor  11  and executed by the processor  11 . This realizes the functions of these functional components. 
       FIG. 1  illustrates only one processor  11 . However, a plurality of processors  11  may be included, and the plurality of processors  11  may cooperate to execute the programs for realizing the functions. 
     ***Description of Operation*** 
     Referring to  FIGS. 3 to 10 , operation of the installation location selection assistance apparatus  10  according to the first embodiment will be described. 
     The operation of the installation location selection assistance apparatus  10  according to the first embodiment corresponds to an installation location selection assistance method according to the first embodiment. The operation of the installation location selection assistance apparatus  10  according to the first embodiment also corresponds to processes of an installation location selection assistance program according to the first embodiment. 
     (Step S 1  of  FIG. 3 : System Configuration Input Process) 
     The system configuration input unit  21  accepts input of system configuration information of a target system  50  in which an intrusion detection system is to be installed. 
     Specifically, the system configuration information of the target system  50  is created by a user. The system configuration input unit  21  acquires the created system configuration information. The system configuration input unit  21  writes the acquired system configuration information in the storage device  12 . 
     As illustrated in  FIG. 4 , a specific example of the system configuration information is drawing data created by existing drawing software such as Microsoft Visio (registered trademark). In  FIG. 4 , the target system  50  includes, as components, a server  51 , three computers  52 A to  52 C, a guest terminal  53 , and communication channels X and Y. In the target system  50 , the server  51  and each of the computers  52 A to  52 C are connected via the communication channel X, and each of the computers  52 A to  52 C and the guest terminal  53  are connected via the communication channel Y. 
     The system configuration information may be data in other formats, such as data that represents the system configuration in the DOT language for expressing a graph using plain text. 
     (Step S 2  of  FIG. 3 : Installation Location Identification Process) 
     The installation location identification unit  26  converts the system configuration information accepted in step S 1  into a graph. 
     Specifically, the installation location identification unit  26  retrieves the system configuration information from the storage device  12 . The installation location identification unit  26  converts the system configuration information into a graph by treating the components of the target system  50  indicated by the system configuration information as nodes (hereinafter referred to as constituent nodes) and expressing a connection between each pair of constituent nodes as an edge. Then, the installation location identification unit  26  extracts each constituent node in the graph resulting from conversion as a location where an intrusion detection system can be installed, and assigns a constituent node number, which is an identifier, to each constituent node. The installation location identification unit  26  writes the graph in which constituent node numbers are assigned to the constituent nodes in the storage device  12 . 
     In the case of the system configuration information illustrated in  FIG. 4 , the server  51 , the three computers  52 A to  52 C, the guest terminal  53 , the communication channel X, and the communication channel Y, which are the components of the target system  50 , are expressed as constituent nodes, as illustrated in  FIG. 5 . Then, edges are provided so that the server  51  and each of the computers  52 A to  52 C are connected via the communication channel X, and each of the computers  52 A to  52 C and the guest terminal  53  are connected via the communication channel Y. In  FIG. 5 , a node number “1” is assigned to the server  51 , a node number “2” is assigned to the communication channel X, a node number “3” is assigned to the computer  52 A, a node number “4” is assigned to the computer  52 B, a node number “5” is assigned to the computer  52 C, a node number “6” is assigned to the communication channel Y, and a node number “7” is assigned to the guest terminal  53 . 
     (Step S 3  of  FIG. 3 : Combination Identification Process) 
     The combination identification unit  27  identifies combinations of one or more components which constitute the target system  50  and in each of which an intrusion detection system can be installed. 
     Specifically, it is assumed that the target system  50  includes n components, where n is an integer of 1 or greater. The combination identification unit  27  identifies all combinations of components for each integer i of i=1, n. The combination identification unit  27  writes the identified combinations in the storage device  12 . 
     In the case of the target system  50  illustrated in  FIG. 5 , n is 7. As illustrated in  FIG. 6 , in the case of the target system  50  illustrated in  FIG. 5 , combinations of i constituent node(s) out of the constituent node number “1” to the constituent node number “7” are identified for each integer i of i=1, . . . , 7. 
     (Step S 4  of  FIG. 3 : Installation Condition Input Process) 
     The installation condition input unit  22  accepts input of an installation condition for an intrusion detection system. 
     Specifically, the installation condition for an intrusion detection system is created by the user. The installation condition input unit  22  acquires the created installation condition. The installation condition input unit  22  writes the acquired installation condition in the storage device  12 . 
     Specific examples of the installation condition include a condition that “no intrusion detection system on a device (host-based IDS, HIDS) is to be installed” and a condition that “an intrusion detection system cannot be installed in a component having a constituent node number XX”. 
     (Step S 5  of  FIG. 3 : First Combination Reduction Process) 
     The combination reduction unit  28  extracts combinations that satisfy the installation condition accepted in step S 4  from all the combinations identified in step S 3 . A combination that satisfies the installation condition is a combination that allows installation of an intrusion detection system when the installation condition is taken into account. 
     Specifically, the combination reduction unit  28  retrieves all the combinations identified in step S 3  and the installation condition accepted in step S 4  from the storage device  12 . Out of all the retrieved combinations, the combination reduction unit  28  excludes combinations that do not satisfy the retrieved installation condition and extracts the remaining combinations. The combination reduction unit  28  thereby reduces the number of combinations. The combination reduction unit  28  writes the extracted combinations in the storage device  12 . 
     As a specific example, when the installation condition is the condition that “no intrusion detection system on a device (host-based IDS, HIDS) is to be installed”, the combination reduction unit  28  excludes all combinations including the constituent nodes having the constituent node numbers “1”, “3”, “4”, “5”, and “7”, which are the constituent nodes that are devices, as combinations not satisfying the installation condition. Then, the combination reduction unit  28  extracts combinations not including the constituent node numbers “1”, “3”, “4”, “5”, and “7”. 
     There are cases in which the user has some previous knowledge about locations that cannot be specified as installation locations of an intrusion detection system or locations not suitable as an installation place of an intrusion detection system, due to constraints related to a business operator or a device. When there are such constraints, the processes of steps S 4  and S 5  are performed in order to reduce the amount of processing of the installation location selection assistance apparatus  10 , using those constraints as installation conditions. Therefore, when there are no such constraints, the processes of steps S 4  and S 5  are omitted. 
     (Step S 6  of  FIG. 3 : Attack Information Input Process) 
     The attack information input unit  24  accepts input of attack information that defines an attack on the target system  50 . 
     Specifically, security analysis is performed and the attack information is created by the user. The attack information input unit  24  acquires the created attack information. The attack information input unit  24  writes the acquired attack information in the storage device  12 . 
     In the first embodiment, the attack information is assumed to be an attack tree expressing the purpose and method of an attack in a tree structure. In the first embodiment, as illustrated in  FIG. 7 , the attack tree has a data structure indicating, for each node (hereinafter referred to as an attack node), a position of the attack node in the attack tree, activity content, and a category. The activity content includes a type and details. The method for describing the attack tree is not limited to the method illustrated in  FIG. 7 , and the attack tree may be described using Extensible Markup Language (XML) data. 
     It is assumed here that the attack tree includes at least one attack node whose category is “unauthorized communication”. In the details of the attack node whose category is “unauthorized communication”, a source and a destination of the unauthorized communication and a forwarding communication channel are indicated. 
     (Step S 7  of  FIG. 3 : Detection Place Identification Process) 
     The detection place identification unit  29  identifies places where an unauthorized communication is to be detected based on the attack information accepted in step S 6 . 
     Specifically, the detection place identification unit  29  retrieves information on the details of the attack node whose category is “unauthorized communication” in the attack tree, which is the attack information accepted in step S 6 , from the storage device  12 . The detection place identification unit  29  identifies the source and the destination of the unauthorized communication and the forwarding communication channel that are indicated by the retrieved information on the details of the attack node. Note here that by installing an intrusion detection system in any one of a source, a destination, and a communication channel that are identified from a certain attack node, it is possible to detect an unauthorized communication, which is an attack indicated by that attack node. Thus, the detection place identification unit  29  treats a source, a destination, and a communication channel that are identified from a certain attack node as places where an unauthorized communication, which is an attack indicated by that attack node, is to be detected. The detection place identification unit  29  writes the identified places where an unauthorized communication is to be detected in the storage device  12 . 
     In the first embodiment, the detection place identification unit  29  expresses the places where an unauthorized communication is to be detected that are indicated by the attack node as a matrix. 
     Specifically, this is expressed like a cover matrix C illustrated in  FIG. 8 . It is assumed here that the attack information indicates an unauthorized communication a i  for each integer i of i=1, . . . , m, as an attack whose category is “unauthorized communication”. It is also assumed that the target system  50  includes a component b j  for each integer j of j=1, . . . , n. The detection place identification unit  29  generates the cover matrix C by setting 1 in an element c ij  at row i and column j if the unauthorized communication a i  is detectable and setting 0 in the element c ij  at row i and column j if the unauthorized communication a i  is not detectable when an intrusion detection system is installed in the component b j . The detection place identification unit  29  writes the generated cover matrix C in the storage device  12 . 
     In the cover matrix C, the elements in column j is information about the component b j . That is, an unauthorized communication indicated by a row in which the element in column j is 1 is an unauthorized communication detectable by installing an intrusion detection system in the component b j . 
     (Step S 8  of  FIG. 3 : Coverage Calculation Process) 
     The coverage calculation unit  30  uses each combination extracted in step S 5  as a target combination, and calculates a coverage, which is a rate of unauthorized communications detectable by the target combination, based on the places where an unauthorized communication is to be detected that are identified in step S 8 . 
     Specifically, in an installation column vector x illustrated in  FIG. 8 , the coverage calculation unit  30  sets 1 in an element x j  in row j of the component b j  included in the target combination and sets 0 in other elements x j . The coverage calculation unit  30  calculates the product of the cover matrix C and the installation column vector x, so as to calculate a cover column vector d having elements d j  of j=1, . . . , m. The coverage calculation unit  30  divides the number of elements d j  having a non-zero value in the cover column vector d by a value m, so as to calculate a rate of unauthorized communications detectable by the target combination. 
     As a result, a coverage and a number of each detectable unauthorized communication are obtained for each combination extracted in step S 5 , as illustrated in  FIG. 9 . A number of each unauthorized communication denotes an index i of the unauthorized communication a i . 
     (Step S 9  of  FIG. 3 : Threshold Input Process) 
     The threshold input unit  23  accepts input of a threshold for the coverage. 
     Specifically, the threshold is set by the user. The threshold input unit  23  acquires the set threshold. The threshold input unit  23  writes the acquired threshold in the storage device  12 . 
     When the threshold is fixed to 100%, the process of step S 9  is omitted. 
     (Step S 10  of  FIG. 3 : Second Combination Reduction Process) 
     The combination reduction unit  28  extracts, from the combinations extracted in step S 5 , combinations that can detect unauthorized communications at a rate higher than or equal to the threshold accepted in step S 9 . 
     Specifically, the combination reduction unit  28  retrieves the threshold accepted in step S 9  from the storage device  12 . The combination reduction unit  28  refers to the coverage of each combination calculated in step S 8 , excludes combinations whose coverage is lower than the threshold, and extracts the remaining combinations. The combination reduction unit  28  thereby reduces the number of combinations. The combination reduction unit  28  writes the extracted combinations in the storage device  12 . 
     (Step S 11  of  FIG. 3 : Parameter Input Process) 
     The parameter input unit  25  accepts input of a parameter for determining an installation location of an intrusion detection system. 
     Specifically, the parameter is input to the parameter input unit  25  by the user. The parameter input unit  25  acquires the input parameter. The parameter input unit  25  writes the acquired parameter in the storage device  12 . 
     Specific examples of the parameter include the maximum number of intrusion detection systems to be installed, the maximum cost associated with installation of intrusion detection systems, and the minimum value of a margin in the amount of processing of an intrusion detection system to be installed. It is assumed that attribute values such as the cost and throughput of each intrusion detection system to be installed are stored in the product information storage unit  34  in advance, as illustrated in  FIG. 10 . 
     (Step S 12  of  FIG. 3 : Objective Function Generation Process) 
     The objective function generation unit  31  retrieves the parameter accepted in step S 11  from the storage device  12  and retrieves the attribute values stored in the product information storage unit  34 . The objective function generation unit  31  generates an objective function for determining one of the combinations extracted in step S 10 , based on the retrieved parameter and attribute values. 
     A specific example is an objective function for reducing the number of intrusion detection systems to be installed, as indicated in Formula 1 of  FIG. 11 . Another specific example is an objective function for reducing the cost associated with installation of intrusion detection systems, as indicated in Formula 2 of  FIG. 11 . Another specific example is an objective function for increasing a margin in the amount of processing obtained by subtracting the maximum value of traffic from throughput, as indicated in Formula 3 of  FIG. 11 . In Formula 3 of  FIG. 11 , the sum of i is calculated. However, as indicated in Formula 4 of  FIG. 11 , an objective function for increasing a margin in the amount of processing for each i may also be considered. 
     In the Formulas illustrated in  FIG. 11 , the sum of i denotes the sum of non-zero elements x j  in the installation column vector x illustrated in  FIG. 8 . In  FIG. 11 , NIDS is an abbreviation for Network Based IDS. In  FIG. 11 , an index b j  indicates that it is related to HIDS, and an index n indicates that it is related to NIDS. 
     (Step S 13  of  FIG. 3 : Objective Function Calculation Process) 
     The objective function calculation unit  32  solves the objective function generated in step S 12  using existing solutions, such as the weighted average method and the constraint method, or using a solver. The objective function calculation unit  32  thereby identifies one combination from the combinations extracted in step S 10  and identifies a specific intrusion detection system to be installed in each node included in the combination. 
     (Step S 14  of  FIG. 3 : Output Process) 
     The output unit  33  outputs the combination identified in step S 13  to the display device. 
     Specifically, the nodes included in the combination identified in step S 13  and the specific intrusion detection system to be installed in each node are output to the display device. 
     Effects of First Embodiment 
     As described above, the installation location selection assistance apparatus  10  according to the first embodiment identifies combinations of components in each of which an intrusion detection system can be installed, and extracts combinations that can detect an unauthorized communication. This limits locations where an intrusion detection system is to be installed. Therefore, selection of a location where an intrusion detection system is to be installed is facilitated. 
     That is, conventionally, an installation location of an intrusion detection system is manually determined, taking into consideration the purpose of installation, the number of observers, IDS specifications, data flows (volumes and directions), a budget, and the like. This work involves a high workload when the scale of a system is large and there are a large number of threats. By introducing the installation location selection assistance apparatus  10  according to the first embodiment, this workload can be reduced. 
     The installation location selection assistance apparatus  10  according to the first embodiment extracts combinations with which a rate of detectable unauthorized communications out of unauthorized communications indicated by the attack information is higher than or equal to the threshold. This further limits locations where an intrusion detection system is to be installed. Therefore, selection of a location where an intrusion detection system is to be installed is further facilitated. 
     The installation location selection assistance apparatus  10  according to the first embodiment extracts combinations that satisfy an installation condition. This further limits locations where an intrusion detection system is to be installed. Therefore, selection of a location where an intrusion detection system is to be installed is further facilitated. 
     The installation location selection assistance apparatus  10  according to the first embodiment identifies a combination suitable for a purpose by calculating an objective function. This facilitates selection of an installation location suitable for the purpose. 
     Other Configurations 
     &lt;First Variation&gt; 
     In the first embodiment, the functional components are realized by software. As a first variation, however, the functional components may be realized by hardware. Regarding this first variation, differences from the first embodiment will be described. 
     Referring to  FIG. 12 , a hardware configuration of the installation location selection assistance apparatus  10  according to the first variation will be described. 
     When the functional components are realized by hardware, the installation location selection assistance apparatus  10  includes an electronic circuit  16  in place of the processor  11  and the storage device  12 . The electronic circuit  16  is a dedicated circuit that realizes the functions of the installation location identification unit  26 , the combination identification unit  27 , the combination reduction unit  28 , the detection place identification unit  29 , the coverage calculation unit  30 , the objective function generation unit  31 , the objective function calculation unit  32 , the product information storage unit  34 , and the storage device  12 . 
     The electronic circuit  16  is assumed to be a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a gate array (GA), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA). 
     The functional components may be realized by one electronic circuit  16 , or the functional components may be distributed among and realized by a plurality of electronic circuits  16 . 
     &lt;Second Variation&gt; 
     As a second variation, some of the functional components may be realized by hardware, and the rest of the functional components may be realized by software. 
     Each of the processor  11 , the storage device  12 , and the electronic circuit  16  is referred to as processing circuitry. That is, the functional components are realized by the processing circuitry. 
     REFERENCE SIGNS LIST 
       10 : installation location selection assistance apparatus,  11 : processor,  12 : storage device,  13 : data interface,  14 : input interface,  15 : display interface,  16 : electronic circuit,  21 : system configuration input unit,  22 : installation condition input unit,  23 : threshold input unit,  24 : attack information input unit,  25 : parameter input unit,  26 : installation location identification unit,  27 : combination identification unit,  28 : combination reduction unit,  29 : detection place identification unit,  30 : coverage calculation unit,  31 : objective function generation unit,  32 : objective function calculation unit,  33 : output unit,  34 : product information storage unit,  50 : target system,  51 : server,  52 : computer,  53 : guest terminal