Intrusion point identification device and intrusion point identification method

An intrusion point identification device that identifies an intrusion point at which a threat intrudes into one or more moving bodies, the intrusion point identification device comprising:

• a processor;
• and
• a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including:
• collecting and storing threat information, the threat information including sets of (i) a threat information number uniquely linked to a moving body identification number identifying a moving body from among the one or more moving bodies into which the threat has intruded, (ii) route information indicating whether an attack by the threat that has intruded into the moving body is an attack by physical access or an attack remotely via a network, (iii) discovery information indicating a discovery date of the attack, and (iv) severity level of vulnerability for the threat;
• (i) collecting logs indicating points that indicate locations of the one or more moving bodies in association with dates and times, each of the points being one of a plurality of predetermined points, (ii) extracting, from the logs collected, histories of points that indicate locations of the one or more moving bodies within a predetermined period, the predetermined period being set based on the discovery information, and (iii) storing the histories of the points as history information;
• identifying an intrusion point of the threat from a first attack source located within a predetermined distance from the moving body by an attack among the points indicated in the history information;
• and
• outputting the intrusion point identified, wherein
• for each of the points indicated in the history information, the processor further calculates and stores a total number of moving bodies that have been at each point indicated in the history information,
• for each of the threat information numbers included in the threat information, the processor (i) extracts points of the moving body corresponding to the moving body identification number included in the history information and (ii) calculates a score indicating a degree of abnormality for each of extracted points by using the route information, the severity level of vulnerability, and the total number of moving bodies at each of the points, and
• the processor identifies the intrusion point of the threat according to the calculated scores.