Security system, security method, and recording medium for storing program

A security method comprising:

• receiving a request from an intruding device attempting an intrusion;
• based on characteristic information of virtual dummy resources, managing whether or not to cause the dummy resource to operate;
• determining whether or not to make a response pretending that the dummy resources caused to virtually operate existed;
• for each of the dummy resources regarding which a response is determined to be made, generating a dummy response, in response to the request to a dummy resource, based on the characteristic information;
• transmitting the dummy response to the intruding device;
• managing whether or not to cause dummy hosts to virtually start, based on characteristic information of dummy hosts to be virtually started, each dummy host having the dummy resource;
• determining whether or not the virtually started dummy hosts respond, based on the request;
• responding in response to the request to at least one of the virtually started hosts;
• and
• generating a dummy response responding in a way to pretend that the dummy resource is provided by any one of the virtually started dummy hosts,
• wherein
• each of the dummy resources is virtually operated when each corresponding resource turns off, and each of the dummy resources is virtually stopped when each corresponding resource turns on, and
• each of the dummy hosts is virtually started when each corresponding communication device turns off, and each of the dummy hosts is virtually stopped when each corresponding communication device turns on.

A non-transitory computer-readable storage medium storing a program causing a computer to perform:

• packet reception processing of receiving a request from an intruding device attempting an intrusion;
• dummy resource operation management processing of managing, based on characteristic information of virtual dummy resources, whether or not to cause the dummy resources to operate;
• dummy resource management processing of determining whether or not to make a response pretending that the dummy resources caused to virtually operate existed;
• dummy response generation processing of, for each of the dummy resources regarding which a response is determined to be made, generating a dummy response, in response to the request to a dummy resource, based on the characteristic information;
• and
• dummy response transmission processing of transmitting the dummy response to the intruding device;
• dummy host operation management processing of determining whether or not to cause dummy hosts to virtually start, based on characteristic information of dummy hosts to be virtually started, each dummy host having the dummy resource;
• dummy host management processing of determining whether or not the virtually started dummy hosts respond, based on the request;
• dummy host response management processing of responding in response to the request to at least one of the virtually started hosts;
• and
• dummy host generation management processing of generating a dummy response responding in a way to pretend that the dummy resource is provided by any one of the virtually started dummy hosts,
• wherein
• each of the dummy resources is virtually operated when each corresponding resource turns off, and each of the dummy resources is virtually stopped when each corresponding resource turns on, and
• each of the dummy hosts is virtually started when each corresponding communication device turns off, and each of the dummy hosts is virtually stopped when each corresponding communication device turns on.