Non-transitory recording medium recording cyber-attack analysis supporting program, cyber-attack analysis supporting method, and cyber-attack analysis supporting apparatus

A cyber-attack analysis supporting method, comprising:

• accepting registration of pieces of information each including one or more items regarding respective cyber-attack events in response to detection of malware in an information processing system of a monitoring target;
• displaying each of the pieces of information registered regarding the respective cyber-attack events in a state in which each of the one or more items is coupled as a subordinate node to a representative node of the respective cyber-attack events;
• displaying pieces of data of the one or more items in a state in which each of the pieces of data is coupled as a sub-subordinate node to a node of the one or more items;
• and
• displaying a coupling state between a first sub-subordinate node of the representative node of one of the cyber attack events and a second sub-subordinate node of the representative node of another of the cyber-attack events when the first sub-subordinate node is associated with the second sub-subordinate node to recognize a relation between the one of the cyber-attack events and the another of the cyber-attack events.

A cyber-attack analysis supporting apparatus, comprising:

• a memory that stores a cyber-attack analysis supporting program;
• and
• a processor that executes a method based on the cyber-attack analysis supporting program, wherein the method includes:
• accepting registration of pieces of information each including one or more items regarding respective cyber-attack events in response to detection of malware in an information processing system of a monitoring target;
• displaying each of the pieces of information registered regarding the respective cyber-attack events in a state in which each of the one or more items is coupled as a subordinate node to a representative node of the respective cyber-attack events;
• displaying pieces of data of the one or more items in a state in which each of the pieces of data is coupled as a sub-subordinate node to a node of the one or more items;
• and
• displaying a coupling state between a first sub-subordinate node of the representative node of one of the cyber attack events and a second sub-subordinate node of the representative node of another of the cyber-attack events when the first sub-subordinate node is associated with the second sub-subordinate node to recognize a relation between the one of the cyber-attack events and the another of the cyber-attack events.