Software attack detection device, non-transitory computer-readable storage medium, and software attack detection method

A non-transitory computer-readable storage medium storing a program that causes a computer to execute a process, the process comprising:

• generating, when a first countermeasure process is applied to the program to address a vulnerability to a software attack, at least one notification including a first countermeasure identifier to identify the first countermeasure process performed;
• monitoring the at least one generated notification;
• identifying, when detecting the at least one generated notification, a past countermeasure identifier for a past countermeasure process by tracing back monitoring information from the first countermeasure identifier;
• and
• performing a second countermeasure process when detecting that the first countermeasure identifier and the past countermeasure identifier correspond to the second countermeasure process, wherein
• the process further includes storing the monitoring information relating to the at least one notification,
• the monitoring information includes the first countermeasure identifier of the first countermeasure process performed, a date and time the first countermeasure process was performed, a process of the program having the vulnerability the first countermeasure process was performed to address, an alert level of the first countermeasure process performed, a corrective action associated with the first countermeasure process, and an alert level of the corrective action.

A software attack detection method executed by a computer, the software attack detection method comprising:

• generating, when a first countermeasure process is applied to a program to address a vulnerability to a software attack, at least one notification including a first countermeasure identifier to identify the first countermeasure process performed;
• monitoring the at least one generated notification;
• identifying, when detecting the at least one generated notification, a past countermeasure identifier for a past countermeasure process by tracing back monitoring information from the first countermeasure identifier;
• and
• performing a second countermeasure process when detecting that the first countermeasure identifier and the past countermeasure identifier correspond to the second countermeasure process, wherein
• the process further includes storing the monitoring information relating to the at least one notification,
• the monitoring information includes the first countermeasure identifier of the first countermeasure process performed, a date and time the first countermeasure process was performed, a process of the program having the vulnerability the first countermeasure process was performed to address, an alert level of the first countermeasure process performed, a corrective action associated with the first countermeasure process, and an alert level of the corrective action.